udb 0.1.0

data/.data/spec/std/isa/isa/globals.isa

@@ -0,0 +1,3124 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+%version: 1.0
+
+include "builtin_functions.idl"
+include "interrupts.idl"
+include "fetch.idl"
+include "util.idl"
+include "fp.idl"
+include "vec.idl"
+
+# global state
+
+# general purpose register file
+# is BUILTIN storage.
+# This is to accommodate the zero register (x0) without
+# needed ISL language support or hard-to-read function calls
+# on any x register read/write
+# Bits<MXLEN> X[31];
+
+############################################################
+# constants used to indicate special values
+############################################################
+
+# CSR field value is undefined, but whatever it is, it must be legal for the field
+Bits<MXLEN> UNDEFINED_LEGAL;
+
+# CSR field value is undefined, but whateer it is, it must be legal for the field and it
+# must be the same value if the same sequence of instructions leading to the read is executed
+Bits<MXLEN> UNDEFINED_LEGAL_DETERMINISTIC;
+
+# Signals an illegal write of a WLRL field
+Bits<67> ILLEGAL_WLRL = 67'h40000000000000000;
+
+# maximum instruction encoding size
+U32 INSTR_ENC_SIZE = 32;
+
+# encoding defined by concatenation of { D, MPV, MPP }:
+# - D  : debug mode  (1b)
+# - MPV: mstatus.MPV (1b)
+# - MPP: mstatus.MPP (2b)
+enum PrivilegeMode {
+  M  0b0011
+  S  0b0001
+  HS 0b0001 # alias for S when H extension is used
+  U  0b0000
+  VS 0b0101
+  VU 0b0100
+  D  0b1011
+}
+
+enum MemoryOperation {
+  Read
+  Write
+  ReadModifyWrite
+  Fetch
+}
+
+# Types of Atomic Read-modify-write operations
+enum AmoOperation {
+  Swap
+  Add
+  And
+  Or
+  Xor
+  Max
+  Maxu
+  Min
+  Minu
+}
+
+enum PmaAttribute {
+  RsrvNone         # LR/SC not allowed
+  RsrvNonEventual  # LR/SC allowed, but no guarantee it will ever succeed
+  RsrvEventual     # LR/SC with forward-progress guarantees
+
+  MAG16            # Misaligned Atomicity Granule = 16-byte
+  MAG8             # Misaligned Atomicity Granule = 8-byte
+  MAG4             # Misaligned Atomicity Granule = 4-byte
+  MAG2             # Misaligned Atomicity Granule = 2-byte
+
+  AmoNone          # No AMOs allowed
+  AmoSwap          # amoswap is allowed
+  AmoLogical       # amoswap, amoand, amoor, and amoxor are allowed
+  AmoArithmetic    # All amos are allowed
+
+  # page walk permissions
+  HardwarePageTableRead    # permission to read during a page walk
+  HardwarePageTableWrite   # permission to write during a page walk
+
+  # Memory types
+  MainMemory          # Main memory region
+  IO                  # I/O region
+  Cacheable           # Cacheable memory region
+  Coherent            # Coherent memory region
+  Idempotent          # Idempotent memory region
+}
+
+enum Pbmt {
+  PMA 0   # Use underlying PMA
+  NC  1   # Non-cacheable, idempotent, weakly-ordered (RVWMO), main memory
+  IO  2   # Non-cacheable, non-idempotent, strongly (channel 0) ordered, I/O
+}
+
+# do not change these values!! the compiler assumes them
+enum CsrFieldType {
+  RO   0
+  ROH  1
+  RW   2
+  RWR  3
+  RWH  4
+  RWRH 5
+}
+
+# generated from extension information in arch definition
+generated enum ExtensionName;
+
+# generated from extension information in arch definition
+generated enum ExceptionCode;
+
+# XLEN encoding, as defined in CSR[mstatus].mxl, etc.
+enum XRegWidth {
+  XLEN32 1
+  XLEN64 2
+}
+
+# enum ExceptionCode {
+#   None 0xffff
+#   InstructionAddressMisaligned 0
+#   InstructionAccessFault 1
+#   IllegalInstruction 2
+#   Breakpoint 3
+#   LoadAddressMisaligned 4
+#   LoadAccessFault 5
+#   StoreAmoAddressMisaligned 6
+#   StoreAmoAccessFault 7
+#   Ucall 8
+#   Scall 9
+#   # reserved 10
+#   Mcall 11
+#   InstructionPageFault 12
+#   LoadPageFault 13
+#   # reserved 14
+#   StoreAmoPageFault 15
+#   # reserved 16-17
+#   SoftwareCheck 18
+#   HardwareError 19
+#   InstructionGuestPageFault 20
+#   LoadGuestPageFault 21
+#   VirtualInstruction 22
+#   StoreAmoGuestPageFault 23
+# }
+
+enum SatpMode {
+  Bare 0
+  Sv32 1
+  Sv39 8
+  Sv48 9
+  Sv57 10
+  Reserved 15
+}
+
+enum HgatpMode {
+  Bare   0
+  Sv32x4 1
+  Sv39x4 8
+  Sv48x4 9
+  Sv57x4 10
+  Reserved 15
+}
+
+bitfield (10) PteFlags {
+  RSW  9-8 # reserved
+  D 7 # dirty
+  A 6 # access
+  G 5 # global
+  U 4 # userspace permission
+  X 3 # execute permission
+  W 2 # write permission
+  R 1 # read permission
+  V 0 # valid
+}
+
+struct TranslationResult {
+  Bits<PHYS_ADDR_WIDTH> paddr;
+  Pbmt pbmt;
+  PteFlags pte_flags;
+}
+
+struct CachedTranslationResult {
+  Boolean valid;
+  TranslationResult result;
+}
+
+# options associated with a translation (TLB) invalidation
+struct VmaOrderType {
+  Boolean global;  # include global mappings?
+  Boolean smode;   # include smode (satp-based) mappings?
+  Boolean vsmode;  # include vsmode (vsatp-based) mappings?
+  Boolean gstage;  # include gstage (hgatp-based) mappings?
+
+  Boolean single_vmid;    # Only order a single VMID?
+  Bits<14> vmid;          # when single_vmid is true, the VMID to order
+  Boolean single_asid;    # Only order a single ASID?
+  Bits<16> asid;          # when single_asid is true, the ASID to order
+  Boolean single_vaddr;   # Only order a single virtual address?
+  XReg vaddr;             # when single_vaddr is true, the virtual address to order
+  Boolean single_gpaddr;  # Only order a single guest physical address?
+  XReg gpaddr;            # when single_gpaddr is true, the guest physical address to order
+}
+
+bitfield (64) Sv39PageTableEntry {
+  N 63
+  PBMT 62-61
+  Reserved 60-54
+  PPN2 53-28
+  PPN1 27-19
+  PPN0 18-10
+  PPN 53-10 # in addition to the components, we define the entire PPN
+  RSW  9-8
+  D 7
+  A 6
+  G 5
+  U 4
+  X 3
+  W 2
+  R 1
+  V 0
+}
+
+PrivilegeMode current_mode = PrivilegeMode::M;
+
+function mode {
+  returns PrivilegeMode
+  description {
+    Returns the current active privilege mode.
+  }
+  body {
+    if ((!implemented?(ExtensionName::S)) &&
+        (!implemented?(ExtensionName::U)) &&
+        (!implemented?(ExtensionName::H))) {
+      return PrivilegeMode::M;
+    } else {
+      return current_mode;
+    }
+  }
+}
+
+
+function set_mode_no_refresh {
+  arguments PrivilegeMode new_mode
+  description {
+    Set the current privilege mode to `new_mode`, but don't refresh interrupts
+  }
+  body {
+    if (new_mode != current_mode) {
+      notify_mode_change(new_mode, current_mode);
+      current_mode = new_mode;
+    }
+  }
+}
+
+function set_mode {
+  arguments PrivilegeMode new_mode
+  description {
+    Set the current privilege mode to `new_mode`
+  }
+  body {
+    if (new_mode != current_mode) {
+      notify_mode_change(new_mode, current_mode);
+      current_mode = new_mode;
+      refresh_pending_interrupts();
+    }
+  }
+}
+
+function compatible_mode? {
+  returns Boolean
+  arguments
+    PrivilegeMode target_mode,
+    PrivilegeMode actual_mode
+  description {
+    Returns true if +target_mode+ is more privileged than +actual_mode+.
+  }
+  body {
+    if (target_mode == PrivilegeMode::M) {
+      return actual_mode == PrivilegeMode::M;
+    } else if (target_mode == PrivilegeMode::S) {
+      return
+        (actual_mode == PrivilegeMode::M) ||
+        (actual_mode == PrivilegeMode::S);
+    } else if (target_mode == PrivilegeMode::U) {
+      return
+        (actual_mode == PrivilegeMode::M) ||
+        (actual_mode == PrivilegeMode::S) ||
+        (actual_mode == PrivilegeMode::U);
+    } else if (target_mode == PrivilegeMode::VS) {
+      return
+        (actual_mode == PrivilegeMode::M) ||
+        (actual_mode == PrivilegeMode::S) ||
+        (actual_mode == PrivilegeMode::VS);
+    } else if (target_mode == PrivilegeMode::VU) {
+      return
+        (actual_mode == PrivilegeMode::M) ||
+        (actual_mode == PrivilegeMode::S) ||
+        (actual_mode == PrivilegeMode::VS) ||
+        (actual_mode == PrivilegeMode::VU);
+    }
+  }
+}
+
+function exception_handling_mode {
+  returns PrivilegeMode
+  arguments ExceptionCode exception_code
+  description {
+    Returns the target privilege mode that will handle synchronous exception `exception_code`
+  }
+  body {
+    if (mode() == PrivilegeMode::M) {
+      # exceptions can never be taken in a less-privileged mode, so if the current
+      # mode is M, the value of medeleg is irrelevant
+      return PrivilegeMode::M;
+    } else if (implemented?(ExtensionName::S) && ((mode() == PrivilegeMode::HS) || (mode() == PrivilegeMode::U))) {
+      if (($bits(CSR[medeleg]) & (MXLEN'1 << $bits(exception_code))) != 0) {
+        return PrivilegeMode::HS;
+      } else {
+        return PrivilegeMode::M;
+      }
+    } else {
+      assert(implemented?(ExtensionName::H) && ((mode() == PrivilegeMode::VS) || (mode() == PrivilegeMode::VU)), "Unexpected mode");
+      if (($bits(CSR[medeleg]) &  (MXLEN'1 << $bits(exception_code))) != 0) {
+        if (($bits(CSR[hedeleg]) & (MXLEN'1 << $bits(exception_code))) != 0) {
+          return PrivilegeMode::VS;
+        } else {
+          return PrivilegeMode::HS;
+        }
+      } else {
+        # if an exception is not delegated to HS-mode, it can't be delegated to VS-mode
+        return PrivilegeMode::M;
+      }
+    }
+  }
+}
+
+function creg2reg {
+  returns Bits<5> # X register index
+  arguments Bits<3> creg_idx
+  description {
+    Maps a C register index (_e.g._, `rs1'` in the specification) to an X register index. From the
+    specification:
+
+    .Registers specified by the three-bit _rs1_&#x2032;, _rs2_&#x2032;, and _rd_&#x2032; fields of the CIW, CL, CS, CA, and CB formats.
+    //[cols="20%,10%,10%,10%,10%,10%,10%,10%,10%"]
+    [float="center",align="center",cols="1a, 1a",frame="none",grid="none"]
+    |===
+    |
+    [%autowidth,cols="<",frame="none",grid="none",options="noheader"]
+    !===
+    !RVC Register Number
+    !Integer Register Number
+    !Integer Register ABI Name
+    !Floating-Point Register Number
+    !Floating-Point Register ABI Name
+    !===
+    |
+
+    [%autowidth,cols="^,^,^,^,^,^,^,^",options="noheader"]
+    !===
+    !`000` !`001` !`010` !`011` !`100` !`101` !`110` !`111`
+    !`x8` !`x9` !`x10` !`x11` !`x12` !`x13` !`x14`!`x15`
+    !`s0` !`s1` !`a0` !`a1` !`a2` !`a3` !`a4`!`a5`
+    !`f8` !`f9` !`f10` !`f11` !`f12` !`f13`!`f14` !`f15`
+    !`fs0` !`fs1` !`fa0` !`fa1` !`fa2` !`fa3` !`fa4` !`fa5`
+    !===
+    |===
+  }
+  body {
+    return {2'b01, creg_idx};
+  }
+}
+
+function reserved_instruction {
+  arguments Bits<INSTR_ENC_SIZE> encoding
+  description {
+    Either raises an IllegalInstruction exception or enters unpredictable state,
+    depending on the setting of the TRAP_ON_UNIMPLEMENTED_INSTRUCTION parameter.
+
+    This should be called when an instruction is architecturally defined but
+    has been disabled at runtime (_e.g._, by clearing misa.A).
+  }
+  body {
+    if (TRAP_ON_UNIMPLEMENTED_INSTRUCTION) {
+      raise(ExceptionCode::IllegalInstruction, mode(), encoding);
+    } else {
+      unpredictable("Unimplemented instruction that does not trap");
+    }
+  }
+}
+
+function unimplemented_csr {
+  arguments Bits<INSTR_ENC_SIZE> encoding
+  description {
+    Either raises an IllegalInstruction exception or enters unpredictable state,
+    depending on the setting of the TRAP_ON_UNIMPLEMENTED_CSR parameter.
+  }
+  body {
+    if (TRAP_ON_UNIMPLEMENTED_CSR) {
+      raise(ExceptionCode::IllegalInstruction, mode(), encoding);
+    } else {
+      unpredictable("Accessing an unimplmented CSR");
+    }
+  }
+}
+
+function mtval_readonly? {
+  returns Boolean
+  description {
+    Returns whether or not CSR[mtval] is read-only based on implementation options
+  }
+  body {
+    return !(
+      REPORT_VA_IN_MTVAL_ON_BREAKPOINT ||
+      REPORT_VA_IN_MTVAL_ON_LOAD_MISALIGNED ||
+      REPORT_VA_IN_MTVAL_ON_STORE_AMO_MISALIGNED ||
+      REPORT_VA_IN_MTVAL_ON_INSTRUCTION_MISALIGNED ||
+      REPORT_VA_IN_MTVAL_ON_LOAD_ACCESS_FAULT ||
+      REPORT_VA_IN_MTVAL_ON_STORE_AMO_ACCESS_FAULT ||
+      REPORT_VA_IN_MTVAL_ON_INSTRUCTION_ACCESS_FAULT ||
+      REPORT_VA_IN_MTVAL_ON_LOAD_PAGE_FAULT ||
+      REPORT_VA_IN_MTVAL_ON_STORE_AMO_PAGE_FAULT ||
+      REPORT_VA_IN_MTVAL_ON_INSTRUCTION_PAGE_FAULT ||
+      REPORT_ENCODING_IN_MTVAL_ON_ILLEGAL_INSTRUCTION ||
+      REPORT_CAUSE_IN_MTVAL_ON_SHADOW_STACK_SOFTWARE_CHECK ||
+      REPORT_CAUSE_IN_MTVAL_ON_LANDING_PAD_SOFTWARE_CHECK
+      # || implemented?(ExtensionName::Sdext)
+    );
+  }
+}
+
+function stval_readonly? {
+  returns Boolean
+  description {
+    Returns whether or not CSR[stval] is read-only based on implementation options
+  }
+  body {
+    if (implemented?(ExtensionName::S)) {
+      return !(
+        REPORT_VA_IN_STVAL_ON_BREAKPOINT ||
+        REPORT_VA_IN_STVAL_ON_LOAD_MISALIGNED ||
+        REPORT_VA_IN_STVAL_ON_STORE_AMO_MISALIGNED ||
+        REPORT_VA_IN_STVAL_ON_INSTRUCTION_MISALIGNED ||
+        REPORT_VA_IN_STVAL_ON_LOAD_ACCESS_FAULT ||
+        REPORT_VA_IN_STVAL_ON_STORE_AMO_ACCESS_FAULT ||
+        REPORT_VA_IN_STVAL_ON_INSTRUCTION_ACCESS_FAULT ||
+        REPORT_VA_IN_STVAL_ON_LOAD_PAGE_FAULT ||
+        REPORT_VA_IN_STVAL_ON_STORE_AMO_PAGE_FAULT ||
+        REPORT_VA_IN_STVAL_ON_INSTRUCTION_PAGE_FAULT ||
+        REPORT_ENCODING_IN_STVAL_ON_ILLEGAL_INSTRUCTION ||
+        REPORT_CAUSE_IN_STVAL_ON_SHADOW_STACK_SOFTWARE_CHECK ||
+        REPORT_CAUSE_IN_STVAL_ON_LANDING_PAD_SOFTWARE_CHECK
+        # || implemented?(ExtensionName::Sdext)
+      );
+    } else {
+      return true;
+    }
+  }
+}
+
+function vstval_readonly? {
+  returns Boolean
+  description {
+    Returns whether or not CSR[vstval] is read-only based on implementation options
+  }
+  body {
+    if (implemented?(ExtensionName::H)) {
+      return !(
+        REPORT_VA_IN_VSTVAL_ON_BREAKPOINT ||
+        REPORT_VA_IN_VSTVAL_ON_LOAD_MISALIGNED ||
+        REPORT_VA_IN_VSTVAL_ON_STORE_AMO_MISALIGNED ||
+        REPORT_VA_IN_VSTVAL_ON_INSTRUCTION_MISALIGNED ||
+        REPORT_VA_IN_VSTVAL_ON_LOAD_ACCESS_FAULT ||
+        REPORT_VA_IN_VSTVAL_ON_STORE_AMO_ACCESS_FAULT ||
+        REPORT_VA_IN_VSTVAL_ON_INSTRUCTION_ACCESS_FAULT ||
+        REPORT_VA_IN_VSTVAL_ON_LOAD_PAGE_FAULT ||
+        REPORT_VA_IN_VSTVAL_ON_STORE_AMO_PAGE_FAULT ||
+        REPORT_VA_IN_VSTVAL_ON_INSTRUCTION_PAGE_FAULT ||
+        REPORT_ENCODING_IN_VSTVAL_ON_ILLEGAL_INSTRUCTION ||
+        REPORT_CAUSE_IN_VSTVAL_ON_SHADOW_STACK_SOFTWARE_CHECK ||
+        REPORT_CAUSE_IN_VSTVAL_ON_LANDING_PAD_SOFTWARE_CHECK
+        # || implemented?(ExtensionName::Sdext)
+      );
+    } else {
+      return true;
+    }
+  }
+}
+
+function mtval_for {
+  returns XReg
+  arguments ExceptionCode exception_code, XReg tval
+  description {
+    Given an exception code and a *legal* non-zero value for mtval,
+    returns the value to be written in mtval considering implementation options
+  }
+  body {
+    if (exception_code == ExceptionCode::Breakpoint) {
+      return REPORT_VA_IN_MTVAL_ON_BREAKPOINT ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadAddressMisaligned) {
+      return REPORT_VA_IN_MTVAL_ON_LOAD_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoAddressMisaligned) {
+      return REPORT_VA_IN_MTVAL_ON_STORE_AMO_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionAddressMisaligned) {
+      return REPORT_VA_IN_MTVAL_ON_INSTRUCTION_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadAccessFault) {
+      return REPORT_VA_IN_MTVAL_ON_LOAD_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoAccessFault) {
+      return REPORT_VA_IN_MTVAL_ON_STORE_AMO_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionAccessFault) {
+      return REPORT_VA_IN_MTVAL_ON_INSTRUCTION_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadPageFault) {
+      return REPORT_VA_IN_MTVAL_ON_LOAD_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoPageFault) {
+      return REPORT_VA_IN_MTVAL_ON_STORE_AMO_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionPageFault) {
+      return REPORT_VA_IN_MTVAL_ON_INSTRUCTION_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::IllegalInstruction) {
+      return REPORT_ENCODING_IN_MTVAL_ON_ILLEGAL_INSTRUCTION ? tval : 0;
+    } else if (exception_code == ExceptionCode::SoftwareCheck) {
+      # software check options are more fine-grained (per-software-check type), so always use tval,
+      # which must be config-checked at the call site
+      return tval;
+    } else {
+      return 0;
+    }
+  }
+}
+
+function stval_for {
+  returns XReg
+  arguments ExceptionCode exception_code, XReg tval
+  description {
+    Given an exception code and a *legal* non-zero value for stval,
+    returns the value to be written in stval considering implementation options
+  }
+  body {
+    if (exception_code == ExceptionCode::Breakpoint) {
+      return REPORT_VA_IN_STVAL_ON_BREAKPOINT ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadAddressMisaligned) {
+      return REPORT_VA_IN_STVAL_ON_LOAD_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoAddressMisaligned) {
+      return REPORT_VA_IN_STVAL_ON_STORE_AMO_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionAddressMisaligned) {
+      return REPORT_VA_IN_STVAL_ON_INSTRUCTION_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadAccessFault) {
+      return REPORT_VA_IN_STVAL_ON_LOAD_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoAccessFault) {
+      return REPORT_VA_IN_STVAL_ON_STORE_AMO_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionAccessFault) {
+      return REPORT_VA_IN_STVAL_ON_INSTRUCTION_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadPageFault) {
+      return REPORT_VA_IN_STVAL_ON_LOAD_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoPageFault) {
+      return REPORT_VA_IN_STVAL_ON_STORE_AMO_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionPageFault) {
+      return REPORT_VA_IN_STVAL_ON_INSTRUCTION_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::IllegalInstruction) {
+      return REPORT_ENCODING_IN_STVAL_ON_ILLEGAL_INSTRUCTION ? tval : 0;
+    } else if (exception_code == ExceptionCode::SoftwareCheck) {
+      # software checks have a fine-grained implementation option (per-software-check type), so always use tval,
+      # which must be config-checked at the call site
+      return tval;
+    } else {
+      return 0;
+    }
+  }
+}
+
+function vstval_for {
+  returns XReg
+  arguments ExceptionCode exception_code, XReg tval
+  description {
+    Given an exception code and a *legal* non-zero value for vstval,
+    returns the value to be written in vstval considering implementation options
+  }
+  body {
+    if (exception_code == ExceptionCode::Breakpoint) {
+      return REPORT_VA_IN_VSTVAL_ON_BREAKPOINT ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadAddressMisaligned) {
+      return REPORT_VA_IN_VSTVAL_ON_LOAD_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoAddressMisaligned) {
+      return REPORT_VA_IN_VSTVAL_ON_STORE_AMO_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionAddressMisaligned) {
+      return REPORT_VA_IN_VSTVAL_ON_INSTRUCTION_MISALIGNED ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadAccessFault) {
+      return REPORT_VA_IN_VSTVAL_ON_LOAD_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoAccessFault) {
+      return REPORT_VA_IN_VSTVAL_ON_STORE_AMO_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionAccessFault) {
+      return REPORT_VA_IN_VSTVAL_ON_INSTRUCTION_ACCESS_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::LoadPageFault) {
+      return REPORT_VA_IN_VSTVAL_ON_LOAD_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::StoreAmoPageFault) {
+      return REPORT_VA_IN_VSTVAL_ON_STORE_AMO_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::InstructionPageFault) {
+      return REPORT_VA_IN_VSTVAL_ON_INSTRUCTION_PAGE_FAULT ? tval : 0;
+    } else if (exception_code == ExceptionCode::IllegalInstruction) {
+      return REPORT_ENCODING_IN_VSTVAL_ON_ILLEGAL_INSTRUCTION ? tval : 0;
+    } else if (exception_code == ExceptionCode::SoftwareCheck) {
+      # software checks have a fine-grained implementation option (per-software-check type), so always use tval,
+      #  which must be config-checked at the call site
+      return tval;
+    } else {
+      return 0;
+    }
+  }
+}
+
+function raise_guest_page_fault {
+  arguments
+    MemoryOperation op,         # op type
+    XReg gpa,                   # guest physical address
+    XReg gva,                   # guest virtual address
+    XReg tinst_value,           # value for *tinst
+    PrivilegeMode from_mode     # effective privilege mode for reporting
+  description {
+    Raise a guest page fault exception.
+  }
+  body {
+    ExceptionCode code;
+    Boolean write_gpa_in_tval;  # whether or not to write GPA >> 2 into htval/mtval2
+
+    if (op == MemoryOperation::Read) {
+      code = ExceptionCode::LoadGuestPageFault;
+      write_gpa_in_tval = REPORT_GPA_IN_TVAL_ON_LOAD_GUEST_PAGE_FAULT;
+    } else if (op == MemoryOperation::Write || op == MemoryOperation::ReadModifyWrite) {
+      code = ExceptionCode::StoreAmoGuestPageFault;
+      write_gpa_in_tval = REPORT_GPA_IN_TVAL_ON_STORE_AMO_GUEST_PAGE_FAULT;
+    } else {
+      assert(op == MemoryOperation::Fetch, "unexpected memory operation");
+      code = ExceptionCode::InstructionGuestPageFault;
+      write_gpa_in_tval = REPORT_GPA_IN_TVAL_ON_INSTRUCTION_GUEST_PAGE_FAULT;
+    }
+
+    PrivilegeMode handling_mode = exception_handling_mode(code);
+
+    if (handling_mode == PrivilegeMode::S) {
+      CSR[htval].VALUE = write_gpa_in_tval ? (gpa >> 2) : 0;
+      CSR[htinst].VALUE = tinst_value;
+      CSR[sepc].PC = $pc;
+      if (!stval_readonly?()) {
+        CSR[stval].VALUE = stval_for(code, gva);
+      }
+      $pc = {CSR[stvec].BASE, 2'b00};
+      CSR[scause].INT = 1'b0;
+      CSR[scause].CODE = $bits(code);
+      CSR[hstatus].GVA = 1;
+      CSR[hstatus].SPV = 1; # guest page faults always come from a virtual mode
+      CSR[hstatus].SPVP = $bits(from_mode)[0];
+      CSR[mstatus].SPP = $bits(from_mode)[0];
+    } else {
+      assert(handling_mode == PrivilegeMode::M, "unexpected privilege mode");
+      CSR[mtval2].VALUE = write_gpa_in_tval ? (gpa >> 2) : 0;
+      CSR[mtinst].VALUE = tinst_value;
+      CSR[mstatus].MPP = $bits(from_mode)[1:0];
+      if (MXLEN == 64) {
+        CSR[mstatus].MPV = 1;
+      } else {
+        CSR[mstatush].MPV = 1;
+      }
+    }
+
+    # abort the current instruction, and start to refetch from PC
+    set_mode(handling_mode);
+    abort_current_instruction();
+  }
+}
+
+function raise {
+  arguments
+    ExceptionCode exception_code, # exception code to raise
+    PrivilegeMode from_mode,      # the effective mode to raise from (may be different than actual current mode)
+    XReg tval                     # value to write into tval
+  description {
+    Raise synchronous exception number `exception_code`.
+
+    The exception may be imprecise, and will cause execution to enter an
+    unpredictable state, if PRECISE_SYNCHRONOUS_EXCEPTIONS is false.
+
+    Otherwise, the exception will be precise.
+  }
+  body {
+    if (!PRECISE_SYNCHRONOUS_EXCEPTIONS) {
+      unpredictable("Imprecise synchronous exception");
+    } else {
+      raise_precise(exception_code, from_mode, tval);
+    }
+  }
+}
+
+function raise_precise {
+  arguments
+    ExceptionCode exception_code, # exception code to raise
+    PrivilegeMode from_mode,      # the effective mode to raise from (may be different than actual current mode)
+    XReg tval                     # value to write into tval
+  description {
+    Raise synchronous exception number `exception_code`.
+  }
+  body {
+    PrivilegeMode handling_mode = exception_handling_mode(exception_code);
+
+    if (handling_mode == PrivilegeMode::M) {
+      CSR[mepc].PC = $pc;
+      if (!mtval_readonly?()) {
+        CSR[mtval].VALUE = mtval_for(exception_code, tval);
+      }
+      $pc = {CSR[mtvec].BASE, 2'b00};
+      CSR[mcause].INT = 1'b0;
+      CSR[mcause].CODE = $bits(exception_code);
+      if (CSR[misa].H == 1) {
+        # write zero into mtval2 and minst
+        # (when these are non-zero values, raise_guest_page_fault should be callecd)
+        CSR[mtval2].VALUE = 0;
+        CSR[mtinst].VALUE = 0;
+        if (from_mode == PrivilegeMode::VU || from_mode == PrivilegeMode::VS) {
+          if (MXLEN == 32) {
+            CSR[mstatush].MPV = 1;
+          } else {
+            CSR[mstatus].MPV = 1;
+          }
+        } else {
+          if (MXLEN == 32) {
+            CSR[mstatush].MPV = 0;
+          } else {
+            CSR[mstatus].MPV = 0;
+          }
+        }
+      }
+      CSR[mstatus].MPP = $bits(from_mode);
+    } else if (CSR[misa].S == 1 && (handling_mode == PrivilegeMode::S)) {
+      CSR[sepc].PC = $pc;
+      if (!stval_readonly?()) {
+        CSR[stval].VALUE = stval_for(exception_code, tval);
+      }
+      $pc = {CSR[stvec].BASE, 2'b00};
+      CSR[scause].INT = 1'b0;
+      CSR[scause].CODE = $bits(exception_code);
+      CSR[mstatus].SPP = $bits(from_mode)[0];
+      if (CSR[misa].H == 1) {
+        # write zero into htval and hinst
+        # (when these are non-zero values, raise_guest_page_fault should be callecd)
+        CSR[htval].VALUE = 0;
+        CSR[htinst].VALUE = 0;
+        CSR[hstatus].SPV = $bits(from_mode)[2];
+        if (from_mode == PrivilegeMode::VU || from_mode == PrivilegeMode::VS) {
+          CSR[hstatus].SPV = 1;
+          if (   ((exception_code == ExceptionCode::Breakpoint) && (REPORT_VA_IN_STVAL_ON_BREAKPOINT))
+              || ((exception_code == ExceptionCode::LoadAddressMisaligned) && (REPORT_VA_IN_STVAL_ON_LOAD_MISALIGNED))
+              || ((exception_code == ExceptionCode::StoreAmoAddressMisaligned) && (REPORT_VA_IN_STVAL_ON_STORE_AMO_MISALIGNED))
+              || ((exception_code == ExceptionCode::InstructionAddressMisaligned) && (REPORT_VA_IN_STVAL_ON_INSTRUCTION_MISALIGNED))
+              || ((exception_code == ExceptionCode::LoadAccessFault) && (REPORT_VA_IN_STVAL_ON_LOAD_ACCESS_FAULT))
+              || ((exception_code == ExceptionCode::StoreAmoAccessFault) && (REPORT_VA_IN_STVAL_ON_STORE_AMO_ACCESS_FAULT))
+              || ((exception_code == ExceptionCode::InstructionAccessFault) && (REPORT_VA_IN_STVAL_ON_INSTRUCTION_ACCESS_FAULT))
+              || ((exception_code == ExceptionCode::LoadPageFault) && (REPORT_VA_IN_STVAL_ON_LOAD_PAGE_FAULT))
+              || ((exception_code == ExceptionCode::StoreAmoPageFault) && (REPORT_VA_IN_STVAL_ON_STORE_AMO_PAGE_FAULT))
+              || ((exception_code == ExceptionCode::InstructionPageFault) && (REPORT_VA_IN_STVAL_ON_INSTRUCTION_PAGE_FAULT))) {
+            # note: guest page faults handled through raise_guest_page_fault
+            CSR[hstatus].GVA = 1;
+          } else {
+            CSR[hstatus].GVA = 0;
+          }
+          CSR[hstatus].SPVP = $bits(from_mode)[0];
+        } else {
+          CSR[hstatus].SPV = 0;
+          CSR[hstatus].GVA = 0;
+        }
+      }
+    } else if (CSR[misa].H == 1 && (handling_mode == PrivilegeMode::VS)) {
+      CSR[vsepc].PC = $pc;
+      if (!vstval_readonly?()) {
+        CSR[vstval].VALUE = vstval_for(exception_code, tval);
+      }
+      $pc = {CSR[vstvec].BASE, 2'b00};
+      CSR[vscause].INT = 1'b0;
+      CSR[vscause].CODE = $bits(exception_code);
+      CSR[vsstatus].SPP = $bits(from_mode)[0];
+    }
+
+    # abort the current instruction, and start to refetch from PC
+    set_mode(handling_mode);
+    abort_current_instruction();
+  }
+}
+
+function ialign {
+  returns Bits<6>
+  description {
+    Returns IALIGN, the smallest instruction encoding size, in bits.
+  }
+  body {
+    if (implemented?(ExtensionName::C) && (CSR[misa].C == 0x1)) {
+      return 16;
+    } else {
+      return 32;
+    }
+  }
+}
+
+function jump {
+  arguments XReg target_addr
+  description {
+    Jump to virtual address `target_addr`.
+
+    If target address is misaligned, raise a `MisalignedAddress` exception.
+  }
+  body {
+    # raise a misaligned exception if address is not aligned to IALIGN
+    if ((ialign() == 16) && ((target_addr & 0x1) != 0)) {
+      # the target PC is not halfword-aligned
+      raise(ExceptionCode::InstructionAddressMisaligned, mode(), target_addr);
+    } else if ((ialign() == 32) && (target_addr & 0x3) != 0) {
+      # the target PC is not word-aligned
+      raise(ExceptionCode::InstructionAddressMisaligned, mode(), target_addr);
+    }
+
+    $pc = target_addr;
+  }
+}
+
+function jump_halfword {
+  arguments XReg target_hw_addr
+  description {
+    Jump to virtual halfword address `target_hw_addr`.
+
+    If target address is misaligned, raise a `MisalignedAddress` exception.
+  }
+  body {
+    # ensure that the target address is really a halfword address
+    assert((target_hw_addr & 0x1) == 0x0, "Expected halfword-aligned address in jump_halfword");
+
+    if (ialign() != 16) {
+      if ((target_hw_addr & 0x3) != 0) {
+        # the target PC is not word-aligned
+        raise(ExceptionCode::InstructionAddressMisaligned, mode(), target_hw_addr);
+      }
+    }
+
+    $pc = target_hw_addr;
+  }
+}
+
+function valid_interrupt_code? {
+  returns Boolean
+  arguments XReg code
+  description {
+    Returns true if _code_ is a legal interrupt number.
+  }
+  body {
+    if (code > ((1 `<< $enum_element_size(InterruptCode)) - 1)) {
+      # code is too large
+      return false;
+    }
+    if ($array_includes?($enum_to_a(InterruptCode), code)) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+}
+
+function valid_exception_code? {
+  returns Boolean
+  arguments XReg code
+  description {
+    Returns true if _code_ is a legal exception number.
+  }
+  body {
+    if (code > ((1 `<< $enum_element_size(ExceptionCode)) - 1)) {
+      # code is too large
+      return false;
+    }
+    if ($array_includes?($enum_to_a(ExceptionCode), code)) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+}
+
+function xlen {
+  returns Bits<8>
+  description {
+    Returns the effective XLEN for the current privilege mode.
+  }
+  body {
+    if (MXLEN == 32) {
+      return 32;
+    } else {
+      if (mode() == PrivilegeMode::M) {
+        if (CSR[misa].MXL == $bits(XRegWidth::XLEN32)) {
+          return 32;
+        } else if (CSR[misa].MXL == $bits(XRegWidth::XLEN64)) {
+          return 64;
+        } else {
+          unreachable();
+        }
+      } else if (implemented?(ExtensionName::S) && mode() == PrivilegeMode::S) {
+        if (CSR[mstatus].SXL == $bits(XRegWidth::XLEN32)) {
+          return 32;
+        } else if (CSR[mstatus].SXL == $bits(XRegWidth::XLEN64)) {
+          return 64;
+        } else {
+          unreachable();
+        }
+      } else if (implemented?(ExtensionName::U) && mode() == PrivilegeMode::U) {
+        if (CSR[mstatus].UXL == $bits(XRegWidth::XLEN32)) {
+          return 32;
+        } else if (CSR[mstatus].UXL == $bits(XRegWidth::XLEN64)) {
+          return 64;
+        } else {
+          unreachable();
+        }
+      } else if (implemented?(ExtensionName::H) && mode() == PrivilegeMode::VS) {
+        if (CSR[hstatus].VSXL == $bits(XRegWidth::XLEN32)) {
+          return 32;
+        } else if (CSR[hstatus].VSXL == $bits(XRegWidth::XLEN64)) {
+          return 64;
+        } else {
+          unreachable();
+        }
+      } else if (implemented?(ExtensionName::H) && mode() == PrivilegeMode::VU) {
+        if (CSR[vsstatus].UXL == $bits(XRegWidth::XLEN32)) {
+          return 32;
+        } else if (CSR[vsstatus].UXL == $bits(XRegWidth::XLEN64)) {
+          return 64;
+        } else {
+          unreachable();
+        }
+      }
+    }
+  }
+}
+
+function virtual_mode? {
+  returns Boolean
+  description {
+    Returns True if the current mode is virtual (VS or VU).
+  }
+  body {
+    return (mode() == PrivilegeMode::VS) || (mode() == PrivilegeMode::VU);
+  }
+}
+
+function mask_eaddr {
+  returns XReg
+  arguments XReg eaddr
+  description {
+    Mask upper N bits of an effective address if pointer masking is enabled
+  }
+  body {
+    #if (implemented?(ExtensionName::Zjpm)) {
+    #  if (mode() == PrivilegeMode::M) {
+    #    if (CSR[mpm].menable) {
+    #      # ignore upper mbits of effective address
+    #      return sext(xlen() - CSR[mpm].mbits, eaddr);
+    #    }
+    #  } else if (mode() == PrivilegeMode::S) { # also applies to HS mode
+    #    if (CSR[spm].senable) {
+    #      # ignore upper sbits of effective address
+    #      return sext(xlen() - CSR[spm].sbits, eaddr);
+    #    }
+    #  } else if (mode() == PrivilegeMode::U || mode() == PrivilegeMode::VU) {
+    #    if (CSR[upm].uenable) {
+    #      # ignore upper ubits of effective address
+    #      return sext(xlen() - CSR[upm].ubits, eaddr);
+    #    }
+    #  }
+    #}
+
+    # by default, eaddr == vaddr
+    return eaddr;
+  }
+}
+
+
+bitfield (8) PmpCfg {
+  L 7
+  Rsvd 6-5
+  A 4-3
+  X 2
+  W 1
+  R 0
+}
+
+enum PmpCfg_A {
+  OFF 0
+  TOR 1
+  NA4 2
+  NAPOT 3
+}
+
+enum PmpMatchResult {
+  NoMatch 0
+  FullMatch 1
+  PartialMatch 2
+}
+
+function pmp_match_64 {
+  returns PmpMatchResult, PmpCfg
+  arguments Bits<PHYS_ADDR_WIDTH> paddr, U32 access_size
+  description {
+    Given a physical address, see if any PMP entry matches.
+
+    If there is a complete match, return the PmpCfg that guards the region.
+    If there is no match or a partial match, report that result.
+  }
+  body {
+    Bits<12> pmpcfg0_addr = 0x3a0;
+    Bits<12> pmpaddr0_addr = 0x3b0;
+
+    for (U32 i=0; i<NUM_PMP_ENTRIES; i++) {
+      # get the registers for this PMP entry
+      Bits<12> pmpcfg_idx = pmpcfg0_addr + (i/8)*2;
+      Bits<6> shamt = (i % 8)*8;
+
+      Csr pmpcfg_csr = direct_csr_lookup(pmpcfg_idx);
+      PmpCfg cfg = (csr_hw_read(pmpcfg_csr) >> shamt)[7:0];
+
+      Bits<12> pmpaddr_idx = pmpaddr0_addr + i;
+      Csr pmpaddr_csr = direct_csr_lookup(pmpaddr_idx);
+      Bits<64> pmpaddr_csr_value = csr_sw_read(pmpaddr_csr);
+
+      # set up the default range limits, which will result in NoMatch when
+      # compared to the access
+      Bits<PHYS_ADDR_WIDTH> range_base = 0;
+      Bits<PHYS_ADDR_WIDTH> range_limit = 0;
+
+      if (cfg.A == $bits(PmpCfg_A::TOR)) {
+        if (i == 0) {
+          # when entry zero is TOR, zero is the lower address bound
+          range_base = 0;
+        } else {
+          # otherwise, it's the address in the next lowest pmpaddr register
+          Csr tor_pmpaddr_csr = direct_csr_lookup(pmpaddr_idx - 1);
+          range_base = (csr_sw_read(tor_pmpaddr_csr))[PHYS_ADDR_WIDTH-1:0];
+        }
+        range_limit = (pmpaddr_csr_value)[PHYS_ADDR_WIDTH-1:0] - 1;
+
+      } else if (cfg.A == $bits(PmpCfg_A::NAPOT)) {
+        # Example pmpaddr: 0b00010101111
+        #                          ^--- last 0 dictates region size & alignment
+        # pmpaddr + 1:     0b00010110000
+        # mask:            0b00000011111
+        # ~mask:           0b11111100000
+        # len = mask + 1:  0b00000100000
+        Bits<PHYS_ADDR_WIDTH-1> pmpaddr_value = pmpaddr_csr_value[PHYS_ADDR_WIDTH-1:0];
+        Bits<PHYS_ADDR_WIDTH-1> mask = pmpaddr_value ^ (pmpaddr_value + 1);
+        range_base = (pmpaddr_value & ~mask);
+        range_limit = range_base + mask;
+
+      } else if (cfg.A == $bits(PmpCfg_A::NA4)) {
+        range_base = pmpaddr_csr_value[PHYS_ADDR_WIDTH-1:0];
+        range_limit = range_base + 3;
+      }
+
+      if (((paddr >> 2) >= range_base) && (((paddr + (access_size/8) - 1) >> 2) <= range_limit)) {
+        # full match
+        return PmpMatchResult::FullMatch, cfg;
+      } else if (!(((paddr + (access_size/8) - 1) < range_base) || (paddr >= range_limit))) {
+        # this is a partial match. By definition, the access must fail, regardless
+        # of the pmp cfg settings
+        return PmpMatchResult::PartialMatch, -;
+      }
+    }
+    # fall-through: there was no match
+    return PmpMatchResult::NoMatch, -;
+  }
+}
+
+function pmp_match_32 {
+  returns PmpMatchResult, PmpCfg
+  arguments Bits<PHYS_ADDR_WIDTH> paddr, U32 access_size
+  description {
+    Given a physical address, see if any PMP entry matches.
+
+    If there is a complete match, return the PmpCfg that guards the region.
+    If there is no match or a partial match, report that result.
+  }
+  body {
+    Bits<12> pmpcfg0_addr = 0x3a0;
+    Bits<12> pmpaddr0_addr = 0x3b0;
+
+    for (U32 i=0; i<NUM_PMP_ENTRIES; i++) {
+      # get the registers for this PMP entry
+      Bits<12> pmpcfg_idx = pmpcfg0_addr + (i/4);
+      Bits<6> shamt = (i % 4)*8;
+
+      Csr pmpcfg_csr = direct_csr_lookup(pmpcfg_idx);
+      PmpCfg cfg = (csr_hw_read(pmpcfg_csr) >> shamt)[7:0];
+
+      Bits<12> pmpaddr_idx = pmpaddr0_addr + i;
+      Csr pmpaddr_csr = direct_csr_lookup(pmpaddr_idx);
+      Bits<32> pmpaddr_csr_value = csr_sw_read(pmpaddr_csr);
+
+      # set up the default range limits, which will result in NoMatch when
+      # compared to the access
+      Bits<PHYS_ADDR_WIDTH> range_base = 0;
+      Bits<PHYS_ADDR_WIDTH> range_limit = 0;
+
+      if (cfg.A == $bits(PmpCfg_A::TOR)) {
+        if (i == 0) {
+          # when entry zero is TOR, zero is the lower address bound
+          range_base = 0;
+        } else {
+          # otherwise, it's the address in the next lowest pmpaddr register
+          Csr tor_pmpaddr_csr = direct_csr_lookup(pmpaddr_idx - 1);
+          range_base = csr_sw_read(tor_pmpaddr_csr)[PHYS_ADDR_WIDTH-1:0];
+        }
+        range_limit = (pmpaddr_csr_value)[PHYS_ADDR_WIDTH-1:0] - 1;
+
+      } else if (cfg.A == $bits(PmpCfg_A::NAPOT)) {
+        # Example pmpaddr: 0b00010101111
+        #                          ^--- last 0 dictates region size & alignment
+        # pmpaddr + 1:     0b00010110000
+        # mask:            0b00000011111
+        # ~mask:           0b11111100000
+        # len = mask + 1:  0b00000100000
+        Bits<PHYS_ADDR_WIDTH-1> pmpaddr_value = pmpaddr_csr_value[PHYS_ADDR_WIDTH-3:0];
+        Bits<PHYS_ADDR_WIDTH-1> mask = pmpaddr_value ^ (pmpaddr_value + 1);
+        range_base = pmpaddr_value & ~mask;
+        range_limit = range_base + mask;
+
+      } else if (cfg.A == $bits(PmpCfg_A::NA4)) {
+        range_base = pmpaddr_csr_value[PHYS_ADDR_WIDTH-1:0];
+        range_limit = range_base + 3;
+      }
+
+      if (((paddr >> 2) >= range_base) && (((paddr + (access_size/8) - 1) >> 2) <= range_limit)) {
+        # full match
+        return PmpMatchResult::FullMatch, cfg;
+      } else if (!(((paddr + (access_size/8) - 1) < range_base) || (paddr >= range_limit))) {
+        # this is a partial match. By definition, the access must fail, regardless
+        # of the pmp cfg settings
+        return PmpMatchResult::PartialMatch, -;
+      }
+    }
+    # fall-through: there was no match
+    return PmpMatchResult::NoMatch, -;
+  }
+}
+
+function pmp_match {
+  returns PmpMatchResult, PmpCfg
+  arguments Bits<PHYS_ADDR_WIDTH> paddr, U32 access_size
+  description {
+    Given a physical address, see if any PMP entry matches.
+
+    If there is a complete match, return the PmpCfg that guards the region.
+    If there is no match or a partial match, report that result.
+  }
+  body {
+    if (MXLEN == 64) {
+      return pmp_match_64(paddr, access_size);
+    } else {
+      return pmp_match_32(paddr, access_size);
+    }
+  }
+}
+
+function mpv {
+  returns Bits<1>
+  description {
+    Returns the current value of CSR[mstatus].MPV (when MXLEN == 64) of CSR[mstatush].MPV (when MXLEN == 32)
+  }
+  body {
+    if (implemented?(ExtensionName::H)) {
+      return (MXLEN == 32) ? CSR[mstatush].MPV : CSR[mstatus].MPV;
+    } else {
+      assert(false, "TODO");
+    }
+  }
+}
+
+
+function effective_ldst_mode {
+  returns PrivilegeMode
+  description {
+    Returns the effective privilege mode for normal explicit loads and stores, taking into account
+    the current actual privilege mode and modifications from `mstatus.MPRV`.
+  }
+  body {
+    # when the mode is M, loads and stores can be executed as if they were done from any other mode
+    # with the use of mstatus.MPRV
+    if (mode() == PrivilegeMode::M) {
+      if (CSR[misa].U == 1 && CSR[mstatus].MPRV == 1) {
+        if (CSR[mstatus].MPP == 0b00) {
+          if (CSR[misa].H == 1 && mpv() == 0b1) {
+            return PrivilegeMode::VU;
+          } else {
+            return PrivilegeMode::U;
+          }
+        } else if (CSR[misa].S == 1 && CSR[mstatus].MPP == 0b01) {
+          if (CSR[misa].H == 1 && mpv() == 0b1) {
+            return PrivilegeMode::VS;
+          } else {
+            return PrivilegeMode::S;
+          }
+        }
+      }
+    }
+
+    # no modifiers were found, return actual mode
+    return mode();
+  }
+}
+
+
+function pmp_check {
+  returns Boolean
+  arguments Bits<PHYS_ADDR_WIDTH> paddr, U32 access_size, MemoryOperation type
+  description {
+    Given a physical address and operation type, return whether or not the access is allowed by PMP.
+  }
+  body {
+    PrivilegeMode mode = effective_ldst_mode();
+    PmpMatchResult match_result;
+    PmpCfg cfg;
+
+    (match_result, cfg) = pmp_match(paddr, access_size);
+
+    if (match_result == PmpMatchResult::FullMatch) {
+      if (mode == PrivilegeMode::M && (cfg.L == 0)) {
+        # when the region is not locked, all M-mode access pass
+        return true;
+      }
+
+      # this is either an HS, VS, VU, or U mode access, or an M mode access with cfg.L set
+      # the RWX settings in cfg apply
+      if (type == MemoryOperation::Write && (cfg.W == 0)) {
+        return false;
+      } else if (type == MemoryOperation::Read && (cfg.R == 0)) {
+        return false;
+      } else if (type == MemoryOperation::Fetch && (cfg.X == 0)) {
+        return false;
+      }
+    } else if (match_result == PmpMatchResult::NoMatch) {
+      # with no matched, M-mode passes and everything else fails
+      if (mode == PrivilegeMode::M) {
+        return true;
+      } else {
+        return false;
+      }
+    } else {
+      assert(match_result == PmpMatchResult::PartialMatch, "PMP matching logic error");
+
+      # by definition, any partial match fails the access, regardless of the config settings
+      return false;
+    }
+
+    # fall-through passes
+    return true;
+  }
+}
+
+function access_check {
+  arguments
+    Bits<PHYS_ADDR_WIDTH> paddr,
+    U32 access_size,
+    XReg vaddr,
+    MemoryOperation type,
+    ExceptionCode fault_type,
+    PrivilegeMode from_mode
+  description {
+    Checks if the physical address paddr is able to access memory, and raises
+    the appropriate exception if not.
+  }
+  body {
+    # check if this is a valid physical address
+    if (paddr > ((1 `<< PHYS_ADDR_WIDTH) - access_size)) {
+      raise(fault_type, from_mode, vaddr);
+    }
+
+    # check PMP
+    if (implemented?(ExtensionName::Smpmp)) {
+      if (!pmp_check(paddr[PHYS_ADDR_WIDTH-1:0], access_size, type)) {
+        raise(fault_type, from_mode, vaddr);
+      }
+    }
+  }
+}
+
+function base32? {
+  returns Boolean
+  description {
+    return True iff current effective XLEN == 32
+  }
+  body {
+    if (MXLEN == 32) {
+      return true;
+    } else {
+      XRegWidth xlen32 = XRegWidth::XLEN32;
+      if (mode() == PrivilegeMode::M) {
+        return CSR[misa].MXL == $bits(xlen32);
+      } else if (implemented?(ExtensionName::S) && mode() == PrivilegeMode::S) {
+        return CSR[mstatus].SXL == $bits(xlen32);
+      } else if (implemented?(ExtensionName::U) && mode() == PrivilegeMode::U) {
+        return CSR[mstatus].UXL == $bits(xlen32);
+      } else if (implemented?(ExtensionName::H) && mode() == PrivilegeMode::VS) {
+        return CSR[hstatus].VSXL == $bits(xlen32);
+      } else {
+        assert(implemented?(ExtensionName::H) && mode() == PrivilegeMode::VU, "Unexpected mode");
+        return CSR[vsstatus].UXL == $bits(xlen32);
+      }
+    }
+  }
+}
+
+function base64? {
+  returns Boolean
+  description {
+    return True iff current effective XLEN == 64
+  }
+  body {
+    return xlen() == 64;
+  }
+}
+
+function current_translation_mode {
+  returns SatpMode
+  arguments
+    PrivilegeMode mode
+  description {
+    Returns the current first-stage translation mode for an explicit load or store
+    from +mode+ given the machine state (e.g., value of `satp` or `vsatp` csr).
+
+    Returns SatpMode::Reserved if the setting found in `satp` or `vsatp` is invalid.
+  }
+  body {
+    PrivilegeMode effective_mode = effective_ldst_mode();
+
+    if (effective_mode == PrivilegeMode::M) {
+      return SatpMode::Bare;
+    }
+
+    if (CSR[misa].H == 1'b1) {
+      if (effective_mode == PrivilegeMode::VS || effective_mode == PrivilegeMode::VU) {
+        Bits<4> mode_val = CSR[vsatp].MODE;
+        if (mode_val == $bits(SatpMode::Bare)) {
+          return SatpMode::Bare;
+        } else if (mode_val == $bits(SatpMode::Sv32)) {
+          # Sv32 is only defined when XLEN == 32
+          if (MXLEN == 64) {
+            if ((effective_mode == PrivilegeMode::VS) && (CSR[hstatus].VSXL != $bits(XRegWidth::XLEN32))) {
+              # not supported in this XLEN
+              return SatpMode::Reserved;
+            }
+            if ((effective_mode == PrivilegeMode::VU) && (CSR[vsstatus].UXL != $bits(XRegWidth::XLEN32))) {
+              # not supported in this XLEN
+              return SatpMode::Reserved;
+            }
+          }
+          if (!SV32_VSMODE_TRANSLATION) {
+            # not supported in this configuration
+            return SatpMode::Reserved;
+          }
+
+          # OK
+          return SatpMode::Sv32;
+        } else if ((MXLEN == 64) && (mode_val == $bits(SatpMode::Sv39))) {
+          # Sv39 is only defined when XLEN == 64
+          if (effective_mode == PrivilegeMode::VS && CSR[hstatus].VSXL != $bits(XRegWidth::XLEN64)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (effective_mode == PrivilegeMode::VU && CSR[vsstatus].UXL != $bits(XRegWidth::XLEN64)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (!SV39_VSMODE_TRANSLATION) {
+            # not supported in this configuration
+            return SatpMode::Reserved;
+          }
+
+          # OK
+          return SatpMode::Sv39;
+        } else if ((MXLEN == 64) && (mode_val == $bits(SatpMode::Sv48))) {
+          # Sv48 is only defined when XLEN == 64
+          if (effective_mode == PrivilegeMode::VS && CSR[hstatus].VSXL != $bits(XRegWidth::XLEN64)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (effective_mode == PrivilegeMode::VU && CSR[vsstatus].UXL != $bits(XRegWidth::XLEN64)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (!SV48_VSMODE_TRANSLATION) {
+            # not supported in this configuration
+            return SatpMode::Reserved;
+          }
+
+          # OK
+          return SatpMode::Sv48;
+        } else if ((MXLEN == 64) && (mode_val == $bits(SatpMode::Sv57))) {
+          # Sv57 is only defined when XLEN == 64
+          if (effective_mode == PrivilegeMode::VS && CSR[hstatus].VSXL != $bits(XRegWidth::XLEN64)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (effective_mode == PrivilegeMode::VU && CSR[vsstatus].UXL != $bits(XRegWidth::XLEN64)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (!SV57_VSMODE_TRANSLATION) {
+            # not supported in this configuration
+            return SatpMode::Reserved;
+          }
+
+          # OK
+          return SatpMode::Sv57;
+        } else {
+          return SatpMode::Reserved;
+        }
+      } else {
+        return SatpMode::Reserved;
+      }
+    } else if (CSR[misa].S == 1'b1) {
+
+      # if we reach here, then the effective mode is S or U
+      assert(effective_mode == PrivilegeMode::S || effective_mode == PrivilegeMode::U, "unexpected priv mode");
+      Bits<4> mode_val = CSR[satp].MODE;
+      if (mode_val == $bits(SatpMode::Bare)) {
+        return SatpMode::Bare;
+      } else if (mode_val == $bits(SatpMode::Sv32)) {
+        # Sv32 is only defined when XLEN == 32
+        if (MXLEN == 64) {
+          if (effective_mode == PrivilegeMode::S && CSR[mstatus].SXL != $bits(XRegWidth::XLEN32)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+          if (effective_mode == PrivilegeMode::U && CSR[sstatus].UXL != $bits(XRegWidth::XLEN32)) {
+            # not supported in this XLEN
+            return SatpMode::Reserved;
+          }
+        }
+        if (!implemented?(ExtensionName::Sv32)) {
+          # not supported in this configuration
+          return SatpMode::Reserved;
+        }
+        # OK
+        return SatpMode::Sv32;
+      } else if ((MXLEN == 64) && (mode_val == $bits(SatpMode::Sv39))) {
+        # Sv39 is only defined when XLEN == 64
+        if (effective_mode == PrivilegeMode::S && CSR[mstatus].SXL != $bits(XRegWidth::XLEN64)) {
+          # not supported in this XLEN
+          return SatpMode::Reserved;
+        }
+        if (effective_mode == PrivilegeMode::U && CSR[sstatus].UXL != $bits(XRegWidth::XLEN64)) {
+          # not supported in this XLEN
+          return SatpMode::Reserved;
+        }
+        if (!implemented?(ExtensionName::Sv39)) {
+          # not supported in this configuration
+          return SatpMode::Reserved;
+        }
+        # OK
+        return SatpMode::Sv39;
+      } else if ((MXLEN == 64) && (mode_val == $bits(SatpMode::Sv48))) {
+        # Sv48 is only defined when XLEN == 64
+        if (effective_mode == PrivilegeMode::S && CSR[mstatus].SXL != $bits(XRegWidth::XLEN64)) {
+          # not supported in this XLEN
+          return SatpMode::Reserved;
+        }
+        if (effective_mode == PrivilegeMode::U && CSR[sstatus].UXL != $bits(XRegWidth::XLEN64)) {
+          # not supported in this XLEN
+          return SatpMode::Reserved;
+        }
+        if (!implemented?(ExtensionName::Sv48)) {
+          # not supported in this configuration
+          return SatpMode::Reserved;
+        }
+        # OK
+        return SatpMode::Sv48;
+      } else if ((MXLEN == 64) && (mode_val == $bits(SatpMode::Sv57))) {
+        # Sv57 is only defined when XLEN == 64
+        if (effective_mode == PrivilegeMode::S && CSR[mstatus].SXL != $bits(XRegWidth::XLEN64)) {
+          # not supported in this XLEN
+          return SatpMode::Reserved;
+        }
+        if (effective_mode == PrivilegeMode::U && CSR[sstatus].UXL != $bits(XRegWidth::XLEN64)) {
+          # not supported in this XLEN
+          return SatpMode::Reserved;
+        }
+        if (!implemented?(ExtensionName::Sv57)) {
+          # not supported in this configuration
+          return SatpMode::Reserved;
+        }
+        # OK
+        return SatpMode::Sv57;
+      } else {
+        return SatpMode::Reserved;
+      }
+    } else {
+      return SatpMode::Reserved;
+    }
+  }
+}
+
+function current_gstage_translation_mode {
+  returns HgatpMode
+  description {
+    Returns the current second-stage translation mode for a load or store
+    from VS-mode or VU-mode.
+  }
+  body {
+    return $enum(HgatpMode, CSR[hgatp].MODE);
+  }
+}
+
+function translate_gstage {
+  returns TranslationResult          # physical address, which is *not* access checked
+  arguments
+    XReg gpaddr,                    # Guest physical address
+    XReg vaddr,                     # original virtual address
+    MemoryOperation op,             # operation type
+    PrivilegeMode effective_mode,   # mode for the translation
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Translates a guest physical address to a physical address.
+  }
+  body {
+    TranslationResult result;
+
+    if (effective_mode == PrivilegeMode::S || effective_mode == PrivilegeMode::U) {
+      # there is no gstage page walk
+      result.paddr = gpaddr;
+      return result;
+    }
+
+    # mstatus.MXR affects G-stage XR, but not hstatus.MXR
+    Boolean mxr = CSR[mstatus].MXR == 1;
+
+    if (GSTAGE_MODE_BARE && CSR[hgatp].MODE == $bits(HgatpMode::Bare)) {
+      # bare mode
+      result.paddr = gpaddr;
+      return result;
+    } else if (SV32X4_TRANSLATION && CSR[hgatp].MODE == $bits(HgatpMode::Sv32x4)) {
+      # Sv39
+      return gstage_page_walk<32, 34, 32, 2>(gpaddr, vaddr, op, effective_mode, false, encoding);
+    } else if (SV39X4_TRANSLATION && CSR[hgatp].MODE == $bits(HgatpMode::Sv39x4)) {
+      # Sv39
+      return gstage_page_walk<39, 56, 64, 3>(gpaddr, vaddr, op, effective_mode, false, encoding);
+    } else if (SV48X4_TRANSLATION && CSR[hgatp].MODE == $bits(HgatpMode::Sv48x4)) {
+      # Sv48
+      return gstage_page_walk<48, 56, 64, 4>(gpaddr, vaddr, op, effective_mode, false, encoding);
+    } else if (SV57X4_TRANSLATION && CSR[hgatp].MODE == $bits(HgatpMode::Sv57x4)) {
+      # Sv57
+      return gstage_page_walk<57, 56, 64, 5>(gpaddr, vaddr, op, effective_mode, false, encoding);
+    } else {
+      # Invalid mode
+      if (op == MemoryOperation::Read) {
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst_value_for_guest_page_fault(op, encoding, true), effective_mode);
+      } else if (op == MemoryOperation::Write || op == MemoryOperation::ReadModifyWrite) {
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst_value_for_guest_page_fault(op, encoding, true), effective_mode);
+      } else {
+        assert(op == MemoryOperation::Fetch, "unexpected memory op");
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst_value_for_guest_page_fault(op, encoding, true), effective_mode);
+      }
+    }
+  }
+}
+
+function tinst_value_for_guest_page_fault {
+  returns
+    XReg   # tinst value
+  arguments
+    MemoryOperation op,
+    Bits<INSTR_ENC_SIZE> encoding,
+    Boolean for_final_vs_pte
+  description {
+    Returns the value of htinst/mtinst for a Guest Page Fault
+  }
+  body {
+    if (for_final_vs_pte) {
+      if (op == MemoryOperation::Fetch) {
+        if (TINST_VALUE_ON_FINAL_INSTRUCTION_GUEST_PAGE_FAULT == "always zero") {
+          return 0;
+        } else {
+          assert(TINST_VALUE_ON_FINAL_INSTRUCTION_GUEST_PAGE_FAULT == "always pseudoinstruction",
+                 "Instruction guest page faults can only report zero/pseudo instruction in tval");
+          return 0x00002000;
+        }
+      } else if (op == MemoryOperation::Read) {
+        if (TINST_VALUE_ON_FINAL_LOAD_GUEST_PAGE_FAULT == "always zero") {
+          return 0;
+        } else if (TINST_VALUE_ON_FINAL_LOAD_GUEST_PAGE_FAULT == "always pseudoinstruction") {
+          if (($array_size(VSXLEN) == 1 && VSXLEN[0] == 32) || ((MXLEN == 64) && (CSR[hstatus].VSXL == $bits(XRegWidth::XLEN32)))) {
+            return 0x00002000;
+          } else {
+            return 0x00003000;
+          }
+        } else if (TINST_VALUE_ON_FINAL_LOAD_GUEST_PAGE_FAULT == "always transformed standard instruction") {
+          return tinst_transform(encoding, 0); # all guest page faults are aligned
+        } else {
+          unpredictable("Custom value written into htinst/mtinst");
+        }
+      } else if (op == MemoryOperation::Write || op == MemoryOperation::ReadModifyWrite) {
+        if (TINST_VALUE_ON_FINAL_STORE_AMO_GUEST_PAGE_FAULT == "always zero") {
+          return 0;
+        } else if (TINST_VALUE_ON_FINAL_STORE_AMO_GUEST_PAGE_FAULT == "always pseudoinstruction") {
+          if (($array_size(VSXLEN) == 1 && VSXLEN[0] == 32) || ((MXLEN == 64) && (CSR[hstatus].VSXL == $bits(XRegWidth::XLEN32)))) {
+            return 0x00002020;
+          } else {
+            return 0x00003020;
+          }
+        } else if (TINST_VALUE_ON_FINAL_STORE_AMO_GUEST_PAGE_FAULT == "always transformed standard instruction") {
+          return tinst_transform(encoding, 0); # all guest page faults are aligned
+        } else {
+          unpredictable("Custom value written into htinst/mtinst");
+        }
+      }
+    } else {
+      if (REPORT_GPA_IN_TVAL_ON_INTERMEDIATE_GUEST_PAGE_FAULT) {
+        # spec states hardware must write the pseduo-instruction values to *tinst
+        if (($array_size(VSXLEN) == 1 && VSXLEN[0] == 32) || ((MXLEN == 64) && (CSR[hstatus].VSXL == $bits(XRegWidth::XLEN32)))) {
+          return 0x00002000;
+        } else if (($array_size(VSXLEN) == 1 && VSXLEN[0] == 64) || ((MXLEN == 64) && (CSR[hstatus].VSXL == $bits(XRegWidth::XLEN64)))) {
+          return 0x00003000;
+        }
+      }
+    }
+  }
+}
+
+function tinst_transform {
+  returns Bits<INSTR_ENC_SIZE> # transformed value
+  arguments
+    Bits<INSTR_ENC_SIZE> encoding,
+    Bits<5> addr_offset     # the offset between the faulting address and the start of the operation (only non-zero for misaligned load/store)
+  description {
+    Returns the standard transformation of an encoding for htinst/mtinst
+  }
+  body {
+    if (encoding[1:0] == 0b11) {
+      if (encoding[6:2] == 5'b00001) {
+        # 32-bit load instruction
+        return {{12{1'b0}}, addr_offset, encoding[14:0]};
+      } else if (encoding[6:2] == 5'b01000) {
+        # 32-bit store instruction
+        return {{7{1'b0}}, encoding[24:20], addr_offset, encoding[14:12], {5{1'b0}}, encoding[6:0]};
+      } else if (encoding[6:2] == 5'b01011) {
+        # 32-bit atomic instruction
+        return {encoding[31:20], addr_offset, encoding[14:0]};
+      } else if (encoding[6:2] == 5'b00011) {
+        # 32-bit virtual machine load/store
+        return {encoding[31:20], addr_offset, encoding[14:0]};
+      } else {
+        assert(false, "Bad transform");
+      }
+    } else {
+      assert(false, "TODO: compressed instruction");
+    }
+  }
+}
+
+function transformed_standard_instruction_for_tinst {
+  returns
+    Bits<INSTR_ENC_SIZE> # transformed instruction encoding
+  arguments
+    Bits<INSTR_ENC_SIZE> original # original instruction encoding
+  description {
+    Transforms an instruction encoding for htinst.
+  }
+  body {
+    assert(false, "TODO");
+    return 0;
+  }
+}
+
+function tinst_value {
+  returns
+    XReg   # tinst value
+  arguments
+    ExceptionCode code, # expect type
+    Bits<INSTR_ENC_SIZE> encoding # instruction encoding, needed when tinst value might be the encoding
+  description {
+    Returns the value of htinst/mtinst for the given exception code.
+  }
+  body {
+    if (code == ExceptionCode::InstructionAddressMisaligned) {
+      if (TINST_VALUE_ON_INSTRUCTION_ADDRESS_MISALIGNED == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to an InstructionAddressMisaligned exception");
+      }
+    } else if (code == ExceptionCode::InstructionAccessFault) {
+      # always zero
+      return 0;
+    } else if (code == ExceptionCode::IllegalInstruction) {
+      # always zero
+      return 0;
+    } else if (code == ExceptionCode::Breakpoint) {
+      if (TINST_VALUE_ON_BREAKPOINT == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a Breakpoint exception");
+      }
+    } else if (code == ExceptionCode::VirtualInstruction) {
+      if (TINST_VALUE_ON_VIRTUAL_INSTRUCTION == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a VirtualInstruction exception");
+      }
+    } else if (code == ExceptionCode::LoadAddressMisaligned) {
+      if (TINST_VALUE_ON_LOAD_ADDRESS_MISALIGNED == "always zero") {
+        return 0;
+      } else if (TINST_VALUE_ON_LOAD_ADDRESS_MISALIGNED == "always transformed standard instruction") {
+        return transformed_standard_instruction_for_tinst(encoding);
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a LoadAddressMisaligned exception");
+      }
+    } else if (code == ExceptionCode::LoadAccessFault) {
+      if (TINST_VALUE_ON_LOAD_ACCESS_FAULT == "always zero") {
+        return 0;
+      } else if (TINST_VALUE_ON_LOAD_ACCESS_FAULT == "always transformed standard instruction") {
+        return transformed_standard_instruction_for_tinst(encoding);
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a LoadAccessFault exception");
+      }
+    } else if (code == ExceptionCode::StoreAmoAddressMisaligned) {
+      if (TINST_VALUE_ON_STORE_AMO_ADDRESS_MISALIGNED == "always zero") {
+        return 0;
+      } else if (TINST_VALUE_ON_STORE_AMO_ADDRESS_MISALIGNED == "always transformed standard instruction") {
+        return transformed_standard_instruction_for_tinst(encoding);
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a StoreAmoAddressMisaligned exception");
+      }
+    } else if (code == ExceptionCode::StoreAmoAccessFault) {
+      if (TINST_VALUE_ON_STORE_AMO_ACCESS_FAULT == "always zero") {
+        return 0;
+      } else if (TINST_VALUE_ON_STORE_AMO_ACCESS_FAULT == "always transformed standard instruction") {
+        return transformed_standard_instruction_for_tinst(encoding);
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a StoreAmoAccessFault exception");
+      }
+    } else if (code == ExceptionCode::Ucall) {
+      if (TINST_VALUE_ON_UCALL == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a UCall exception");
+      }
+    } else if (code == ExceptionCode::Scall) {
+      if (TINST_VALUE_ON_SCALL == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a SCall exception");
+      }
+    } else if (code == ExceptionCode::Mcall) {
+      if (TINST_VALUE_ON_MCALL == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a MCall exception");
+      }
+    } else if (code == ExceptionCode::VScall) {
+      if (TINST_VALUE_ON_VSCALL == "always zero") {
+        return 0;
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a VSCall exception");
+      }
+    } else if (code == ExceptionCode::InstructionPageFault) {
+      return 0;
+    } else if (code == ExceptionCode::LoadPageFault) {
+      if (TINST_VALUE_ON_LOAD_PAGE_FAULT == "always zero") {
+        return 0;
+      } else if (TINST_VALUE_ON_LOAD_PAGE_FAULT == "always transformed standard instruction") {
+        return transformed_standard_instruction_for_tinst(encoding);
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a LoadPageFault exception");
+      }
+    } else if (code == ExceptionCode::StoreAmoPageFault) {
+      if (TINST_VALUE_ON_STORE_AMO_PAGE_FAULT == "always zero") {
+        return 0;
+      } else if (TINST_VALUE_ON_STORE_AMO_PAGE_FAULT == "always transformed standard instruction") {
+        return transformed_standard_instruction_for_tinst(encoding);
+      } else {
+        unpredictable("An unpredictable value is written into tinst in response to a StoreAmoPageFault exception");
+      }
+    } else {
+      assert(false, "Unhandled exception type");
+    }
+  }
+}
+
+function gstage_page_walk {
+  template
+    U32 VA_SIZE,     # virtual address size  (Sv32 = 32, Sv39 = 39, Sv48 = 48, Sv57 = 57)
+    U32 PA_SIZE,     # physical address size (Sv32 = 34, Sv39 = 56, Sv48 = 56, Sv57 = 56)
+    U32 PTESIZE,     # length, in bits, of a Page Table Entry (Sv32 = 32, others = 64)
+    U32 LEVELS       # levels in the page table (Sv32 = 2, Sv39 = 3, Sv48 = 4, Sv57 = 5)
+  returns
+    TranslationResult  # the translated address and attributes
+  arguments
+    XReg gpaddr,                     # the guest physical address to translate
+    XReg vaddr,                      # the original virtual address to translate
+    MemoryOperation op,              # the operation type
+    PrivilegeMode effective_mode,    # the mode for this walk (usually effective_ldst_mode(), though different for HLV/HLX/HSV)
+    Boolean for_final_vs_pte,        # true when this walk is for a final translation, rather than an intermediate VS-stage translation to get the paddr of a guest PTE
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Translate guest physical address to physical address through a page walk.
+
+    May raise a Guest Page Fault if an error involving the page table structure occurs along the walk.
+
+    Implicit reads of the page table are accessed check, and may raise Access Faults.
+    Implicit writes (updates of A/D) are also accessed checked, and may raise Access Faults
+
+    The translated address _is not_ accessed checked.
+
+    Returns the translated physical address.
+  }
+  body {
+    Bits<PA_SIZE> ppn;
+    TranslationResult result;
+
+    # the VPN size is 10 bits in Sv32, and 9 bits in all others
+    U32 VPN_SIZE = (LEVELS == 2) ? 10 : 9;
+
+    # if there is an exception, set up the correct type
+    ExceptionCode access_fault_code =
+      op == MemoryOperation::Read ?
+        ExceptionCode::LoadAccessFault :
+        ( op == MemoryOperation::Fetch ?
+            ExceptionCode::InstructionAccessFault :
+            ExceptionCode::StoreAmoAccessFault );
+
+    ExceptionCode page_fault_code =
+      op == MemoryOperation::Read ?
+        ExceptionCode::LoadGuestPageFault :
+        ( op == MemoryOperation::Fetch ?
+            ExceptionCode::InstructionGuestPageFault :
+            ExceptionCode::StoreAmoGuestPageFault );
+
+    Boolean mxr = for_final_vs_pte && (CSR[mstatus].MXR == 1);
+    Boolean pbmte = implemented?(ExtensionName::Svpbmt) && CSR[menvcfg].PBMTE == 1;
+    Boolean adue = implemented?(ExtensionName::Svadu) && CSR[menvcfg].ADUE == 1;
+
+    # set up the value that will be written into mtinst/htinst, if required
+    Bits<32> tinst = tinst_value_for_guest_page_fault(op, encoding, for_final_vs_pte);
+
+    U32 max_gpa_width = LEVELS * VPN_SIZE + 2 + 12;
+    if (gpaddr >> max_gpa_width != 0) {
+      # Guest physical address is too large for the page table
+      raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+    }
+
+    ppn = CSR[hgatp].PPN;
+
+    for (U32 i = (LEVELS - 1); i >= 0; i--) {
+      # first level is x4 for G-stage, so add two bits to the vpn size
+      U32 this_vpn_size = (i == (LEVELS - 1)) ? VPN_SIZE + 2 : VPN_SIZE;
+      U32 vpn = (gpaddr >> (12 + VPN_SIZE*i)) & ((1 << this_vpn_size) - 1);
+
+      Bits<PA_SIZE> pte_paddr = (ppn << 12) + (vpn * (PTESIZE/8));
+
+      # check hw page table access permission
+      if (!pma_applies?(PmaAttribute::HardwarePageTableRead, pte_paddr, PTESIZE)) {
+        raise (access_fault_code, PrivilegeMode::U, vaddr);
+      }
+      access_check(pte_paddr, PTESIZE, vaddr, MemoryOperation::Read, access_fault_code, effective_mode);
+
+      Bits<PTESIZE> pte = read_physical_memory<PTESIZE>(pte_paddr);
+      PteFlags pte_flags = pte[9:0];
+
+      # check if any reserved bits are set
+      # Sv32 has no reserved bits, and Sv39/48/57 all have reserved bits at 58:54
+      if ((VA_SIZE != 32) && (pte[58:54] != 0)) {
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+      }
+      if (!implemented?(ExtensionName::Svrsw60t59b)) {
+        if ((PTESIZE >= 64) && pte[60:59] != 0) {
+          # 60:59 are reserved if Svrsw60t59b is not supported
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+      }
+      if (!implemented?(ExtensionName::Svnapot)) {
+        if ((PTESIZE >= 64) && pte[63] != 0) {
+          # N is reserved if Svnapot is not supported
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+      }
+      if ((PTESIZE >= 64) && !pbmte && (pte[62:61] != 0)) {
+        # PBMTE is reserved when Svpbmt is not enabled
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+      }
+      if ((PTESIZE >= 64) && pbmte && (pte[62:61] == 3)) {
+        # PBMTE == 3 is reserved
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+      }
+
+      if (pte_flags.V == 0) {
+        # page table entry is not valid
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+      }
+
+      if (pte_flags.R == 0 && pte_flags.W == 1) {
+        # Writable pages must also be readable
+        raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+      }
+
+      if (pte_flags.R == 1 || pte_flags.X == 1) {
+        # leaf page table
+        if (pte_flags.U == 0) {
+          # all g-stage tables *must* be user mode accessible
+          # since all g-stage accesses appear like U-mode accesses
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+
+        if (((op == MemoryOperation::Write) || (op == MemoryOperation::ReadModifyWrite))
+             && (pte_flags.W == 0)) {
+          # not write permission for store
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        } else if ((op == MemoryOperation::Fetch)
+                    && (pte_flags.X == 0)) {
+          # no execute permission
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        } else if ((op == MemoryOperation::Read) || (op == MemoryOperation::ReadModifyWrite)) {
+          if (((!mxr) && (pte_flags.R == 0))
+              || ((mxr) && (pte_flags.X == 0 && pte_flags.R == 0))) {
+            # no read permission
+            raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+          }
+        }
+
+        # ensure remaining PPN bits are zero, otherwise there is a misaligned super page
+        if ((i > 0) && (pte[(i-1)*VPN_SIZE:0] != 0)) {
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+
+        # check access and dirty bits
+        if ((pte_flags.A == 0)         # access is clear
+             || ((pte_flags.D == 0)    # or dirty is clear and this is a (read-modify-)write
+                 && ((op == MemoryOperation::Write)
+                     || (op == MemoryOperation::ReadModifyWrite)))) {
+
+          # check for hardware update of A/D bits
+          if (adue) {
+            # Svadu requires page tables to be located in memory with hardware page-table write access
+            # and RsrvEventual PMA
+            if (!pma_applies?(PmaAttribute::RsrvEventual, pte_paddr, PTESIZE)) {
+              raise (access_fault_code, PrivilegeMode::U, vaddr);
+            }
+            if (!pma_applies?(PmaAttribute::HardwarePageTableWrite, pte_paddr, PTESIZE)) {
+              raise (access_fault_code, PrivilegeMode::U, vaddr);
+            }
+
+            access_check(pte_paddr, PTESIZE, vaddr, MemoryOperation::Write, access_fault_code, effective_mode);
+
+            Boolean success;
+            Bits<PTESIZE> updated_pte;
+            if (pte_flags.D == 0 && (op == MemoryOperation::Write || op == MemoryOperation::ReadModifyWrite)) {
+              # try to set both A and D bits
+              updated_pte = pte | 0b11000000;
+            } else {
+              # try to set the A bit
+              updated_pte = pte | 0b01000000;
+            }
+
+            if (PTESIZE == 32) {
+              success = atomic_check_then_write_32(pte_paddr, pte, updated_pte);
+            } else if (PTESIZE == 64) {
+              success = atomic_check_then_write_64(pte_paddr, pte, updated_pte);
+            } else {
+              assert(false, "Unexpected PTESIZE");
+            }
+
+
+            if (!success) {
+              # the PTE changed between the read during the walk and the attempted atomic update
+              # roll back, and try this level again
+              i = i + 1;
+            } else {
+              # successful translation and update
+              result.paddr = pte_paddr;
+              if (PTESIZE >= 64) {
+                result.pbmt = $enum(Pbmt, pte[62:61]);
+              }
+              result.pte_flags = pte_flags;
+              return result;
+            }
+          } else {
+            # A or D bit needs updated
+            raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+          }
+        }
+
+      } else {
+        # pointer to next level
+        if (i == 0) {
+          # a pointer can't exist on the last level
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+
+        if (pte_flags.D == 1 || pte_flags.A == 1 || pte_flags.U == 1) {
+          # D, A, and U are reserved in non-leaf PTEs
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+
+        if ((VA_SIZE != 32) && (pte[62:61] != 0)) {
+          # PBMT must be zero in a pointer PTE
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+
+        if ((VA_SIZE != 32) && pte[63] != 0) {
+          # N must be zero in a pointer PTE
+          raise_guest_page_fault(op, gpaddr, vaddr, tinst, effective_mode);
+        }
+
+        # fall through to next level
+        ppn = pte[PA_SIZE-3:10] << 12;
+      }
+    }
+  }
+}
+
+
+function stage1_page_walk {
+  template
+    U32 VA_SIZE,     # virtual address size  (Sv32 = 32, Sv39 = 39, Sv48 = 48, Sv57 = 57)
+    U32 PA_SIZE,     # physical address size (Sv32 = 34, Sv39 = 56, Sv48 = 56, Sv57 = 56)
+    U32 PTESIZE,     # length, in bits, of a Page Table Entry (Sv32 = 4, others = 8)
+    U32 LEVELS       # levels in the page table (Sv32 = 2, Sv39 = 3, Sv48 = 4, Sv57 = 5)
+  returns
+    TranslationResult  # the translated address and attributes
+  arguments
+    Bits<MXLEN> vaddr,            # the virtual address to translate
+    MemoryOperation op,           # the operation type
+    PrivilegeMode effective_mode, # the mode for this walk (usually effective_ldst_mode(), though different for HLV/HLX/HSV)
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Translate virtual address to physical address through a page walk.
+
+    May raise a Page Fault if an error involving the page table structure occurs along the walk.
+
+    Implicit reads of the page table are accessed check, and may raise Access Faults.
+    Implicit writes (updates of A/D) are also accessed checked, and may raise Access Faults
+
+    The translated address _is not_ accessed checked.
+
+    Returns the translated guest physical address.
+  }
+  body {
+    Bits<PA_SIZE> ppn;
+    TranslationResult result;
+
+    # the VPN size is 10 bits in Sv32, and 9 bits in all others
+    U32 VPN_SIZE = (LEVELS == 2) ? 10 : 9;
+
+    # if there is an exception, set up the correct type
+    ExceptionCode access_fault_code =
+      op == MemoryOperation::Read ?
+        ExceptionCode::LoadAccessFault :
+        ( op == MemoryOperation::Fetch ?
+            ExceptionCode::InstructionAccessFault :
+            ExceptionCode::StoreAmoAccessFault );
+
+    ExceptionCode page_fault_code =
+      op == MemoryOperation::Read ?
+        ExceptionCode::LoadPageFault :
+        ( op == MemoryOperation::Fetch ?
+            ExceptionCode::InstructionPageFault :
+            ExceptionCode::StoreAmoPageFault );
+
+    # shadow stacks enabled?
+    Boolean sse = false;
+    # if (CSR[misa].H == 1 && effective_mode == PrivilegeMode::VS) {
+    #   sse = CSR[henvcfg].SSE == 1;
+    # } else if (CSR[misa].H == 1 && effective_mode == PrivilegeMode::VU) {
+    #   sse = CSR[senvcfg].SSE == 1;
+    # } else if (CSR[misa].U == 1 && effective_mode == PrivilegeMode::U) {
+    #   sse = CSR[senvcfg].SSE == 1;
+    # } else if (CSR[misa].S == 1 && effective_mode == PrivilegeMode::S) {
+    #   sse = CSR[menvcfg].SSE == 1;
+    # } else {
+    #   # M-mode
+    #   sse = false;
+    # }
+
+    # access/dirty bit hardware update enable?
+    Boolean adue;
+    if (CSR[misa].H == 1 && (effective_mode == PrivilegeMode::VS || effective_mode == PrivilegeMode::VU)) {
+      adue = implemented?(ExtensionName::Svadu) && CSR[henvcfg].ADUE == 1;
+    } else {
+      adue = implemented?(ExtensionName::Svadu) && CSR[menvcfg].ADUE == 1;
+    }
+
+    # Page-based memory type enable?
+    Boolean pbmte;
+    if (VA_SIZE == 32) {
+      # not Sv32 (PBMT is not defined for Sv32)
+      pbmte = false;
+    } else {
+      if (CSR[misa].H == 1 && (effective_mode == PrivilegeMode::VS || effective_mode == PrivilegeMode::VU)) {
+        pbmte = implemented?(ExtensionName::Svpbmt) && CSR[henvcfg].PBMTE == 1;
+      } else {
+        pbmte = implemented?(ExtensionName::Svpbmt) && CSR[menvcfg].PBMTE == 1;
+      }
+    }
+
+    # make execute readable?
+    Boolean mxr;
+    if (CSR[misa].H == 1 && (effective_mode == PrivilegeMode::VS || effective_mode == PrivilegeMode::VU)) {
+      # HS-level sstatus.MXR makes execute-only pages readable for both stages of address translation
+      # (VS-stage and G-stage), whereas vsstatus.MXR affects only the first translation stage (VS-stage)
+      mxr = (CSR[mstatus].MXR == 1) || (CSR[vsstatus].MXR == 1);
+      ppn = CSR[vsatp].PPN;
+    } else {
+      mxr = CSR[mstatus].MXR == 1;
+      ppn = CSR[satp].PPN;
+    }
+
+    # Supervisor access user page?
+    Boolean sum;
+    if (CSR[misa].H == 1 && (effective_mode == PrivilegeMode::VS)) {
+      sum = CSR[vsstatus].SUM == 1;
+    } else {
+      sum = CSR[mstatus].SUM == 1;
+    }
+
+    if ((VA_SIZE < xlen()) && (vaddr[xlen()-1:VA_SIZE] != {xlen()-VA_SIZE{vaddr[VA_SIZE - 1]}})) {
+      # non-canonical virtual address raises a page fault
+      # note that if pointer masking is enabled,
+      # vaddr has already been transformed before reaching here
+      raise (page_fault_code, mode(), vaddr);
+    }
+
+    for (U32 I = (LEVELS - 1); I >= 0; I--) {
+      U32 vpn = (vaddr >> (12 + VPN_SIZE*I)) & ((1 `<< VPN_SIZE) - 1);
+
+      Bits<PA_SIZE> pte_gpaddr = (ppn << 12) + (vpn * (PTESIZE/8));
+
+      TranslationResult pte_phys =
+        translate_gstage(
+          pte_gpaddr,
+          vaddr,
+          MemoryOperation::Read,
+          effective_mode,
+          encoding
+        );
+
+      # check hw page table access permission
+      if (!pma_applies?(PmaAttribute::HardwarePageTableRead, pte_phys.paddr, PTESIZE)) {
+        raise (access_fault_code, mode(), vaddr);
+      }
+
+      # perform access check on the physical address of pte before it's used
+      access_check(pte_phys.paddr, PTESIZE, vaddr, MemoryOperation::Read, access_fault_code, effective_mode);
+
+      Bits<PTESIZE> pte = read_physical_memory<PTESIZE>(pte_phys.paddr);
+      PteFlags pte_flags = pte[9:0];
+
+      # shadow stack page?
+      Boolean ss_page = (pte_flags.R == 0) && (pte_flags.W == 1) && (pte_flags.X == 0);
+
+      # check if any reserved bits are set
+      # Sv32 has no reserved bits, and Sv39/48/57 all have reserved bits at 58:54
+      if ((VA_SIZE != 32) && (pte[58:54] != 0)) {
+        raise(page_fault_code, mode(), vaddr);
+      }
+
+      if (pte_flags.V == 0) {
+        # invalid entry
+        raise (page_fault_code, mode(), vaddr);
+      }
+
+      if (!sse) {
+        if ((pte_flags.R == 0) && (pte_flags.W == 1)) {
+          # write permission must also have read permission
+          raise (page_fault_code, mode(), vaddr);
+        }
+      }
+
+      if (pbmte) {
+        # PBMT == 3 is reserved
+        if (pte[62:61] == 3) {
+          raise (page_fault_code, mode(), vaddr);
+        }
+      } else {
+        # PBMT is reserved if Svpbmt is not supported)
+        if ((PTESIZE >= 64) && (pte[62:61] != 0)) {
+          raise (page_fault_code, mode(), vaddr);
+        }
+      }
+
+      if (!implemented?(ExtensionName::Svrsw60t59b)) {
+        if ((PTESIZE >= 64) && pte[60:59] != 0) {
+          # 60:59 are reserved if Svrsw60t59b is not supported
+          raise (page_fault_code, mode(), vaddr);
+        }
+      }
+
+      if (!implemented?(ExtensionName::Svnapot)) {
+        if ((PTESIZE >= 64) && (pte[63] != 0)) {
+          # N is reserved if Svnapot is not supported
+          raise (page_fault_code, mode(), vaddr);
+        }
+      }
+
+      if (pte_flags.R == 1 || pte_flags.X == 1) {
+        # found a leaf PTE
+        Bits<PA_SIZE> paddr_base = pte[PA_SIZE-3:I*VPN_SIZE + 10] `<< (I*VPN_SIZE + 12);
+        Bits<PA_SIZE> offset = vaddr[I*VPN_SIZE + 11:0];
+
+        # see if there is permission to perform the access
+        if (op == MemoryOperation::Read || op == MemoryOperation::ReadModifyWrite) {
+          if (((!mxr) && (pte_flags.R == 0))
+              || ((mxr) && (pte_flags.X == 0 && pte_flags.R == 0))) {
+            # no read permission
+            raise (page_fault_code, mode(), vaddr);
+          }
+
+          if (effective_mode == PrivilegeMode::U && pte_flags.U == 0) {
+            # U-mode can never access supervisor page
+            raise (page_fault_code, mode(), vaddr);
+          } else if (CSR[misa].H == 1 && effective_mode == PrivilegeMode::VU && pte_flags.U == 0) {
+            # VU-mode can never access supervisor page
+            raise (page_fault_code, mode(), vaddr);
+          } else if (effective_mode == PrivilegeMode::S && pte_flags.U == 1 && !sum) {
+            # S-mode cannot access User page unless mstatus.SUM == 1
+            raise (page_fault_code, mode(), vaddr);
+          } else if (effective_mode == PrivilegeMode::VS && pte_flags.U == 1 && !sum) {
+            # VS-mode cannot access User page unless vsstatus.SUM == 1
+            raise (page_fault_code, mode(), vaddr);
+          }
+        }
+        if (((op == MemoryOperation::Write) || (op == MemoryOperation::ReadModifyWrite))
+             && (pte_flags.W == 0)) {
+          # no write permission
+          raise (page_fault_code, mode(), vaddr);
+        } else if ((op == MemoryOperation::Fetch) && (pte_flags.X == 0)) {
+          # no execute permission
+          raise (page_fault_code, mode(), vaddr);
+        } else if ((op == MemoryOperation::Fetch) && ss_page) {
+          # fetch from Shadow Stack never allowed
+          raise (page_fault_code, mode(), vaddr);
+        }
+
+        # ensure remaining PPN bits are zero, otherwise there is a misaligned super page
+        raise (page_fault_code, mode(), vaddr) if ((I > 0) && (pte[I*VPN_SIZE + 10:10] != 0));
+
+        # check access and dirty bits
+        if ((pte_flags.A == 0)         # access is clear
+             || ((pte_flags.D == 0)    # or dirty is clear and this is a (read-modify-)write
+                 && ((op == MemoryOperation::Write)
+                     || (op == MemoryOperation::ReadModifyWrite)))) {
+
+          # check for hardware update of A/D bits
+          if (adue) {
+            # translate again, this time with write permission
+            TranslationResult pte_phys =
+              translate_gstage(
+                pte_gpaddr,
+                vaddr,
+                MemoryOperation::Write,
+                effective_mode,
+                encoding
+              );
+
+            # Svadu requires page tables to be located in memory with hardware page-table write access
+            # and RsrvEventual PMA
+            if (!pma_applies?(PmaAttribute::RsrvEventual, pte_phys.paddr, PTESIZE)) {
+              raise (access_fault_code, effective_mode, vaddr);
+            }
+            if (!pma_applies?(PmaAttribute::HardwarePageTableWrite, pte_phys.paddr, PTESIZE)) {
+              raise (access_fault_code, effective_mode, vaddr);
+            }
+
+            access_check(pte_phys.paddr, PTESIZE, vaddr, MemoryOperation::Write, access_fault_code, effective_mode);
+
+            Boolean success;
+            Bits<PTESIZE> updated_pte;
+            if (pte_flags.D == 0 && (op == MemoryOperation::Write || op == MemoryOperation::ReadModifyWrite)) {
+              # try to set both A and D bits
+              updated_pte = pte | 0b11000000;
+            } else {
+              # try to set the A bit
+              updated_pte = pte | 0b01000000;
+            }
+
+            if (PTESIZE == 32) {
+              success = atomic_check_then_write_32(pte_phys.paddr, pte, updated_pte);
+            } else if (PTESIZE == 64) {
+              success = atomic_check_then_write_64(pte_phys.paddr, pte, updated_pte);
+            } else {
+              assert(false, "Unexpected PTESIZE");
+            }
+
+
+            if (!success) {
+              # the PTE changed between the read during the walk and the attempted atomic update
+              # roll back, and try this level again
+              I = I + 1;
+            } else {
+              # successful translation and update
+
+              TranslationResult pte_phys = translate_gstage(
+                  paddr_base + offset,
+                  vaddr,
+                  op,
+                  effective_mode,
+                  encoding
+                );
+              result.paddr = pte_phys.paddr;
+              result.pbmt = pte_phys.pbmt == Pbmt::PMA ? $enum(Pbmt, pte[62:61]) : pte_phys.pbmt;
+              result.pte_flags = pte_flags;
+              return result;
+            }
+          } else {
+            # A or D bit needs updated
+            raise(page_fault_code, mode(), vaddr);
+          }
+        }
+
+        # translation succeeded
+        TranslationResult pte_phys =
+          translate_gstage(
+            paddr_base + offset,
+            vaddr,
+            op,
+            effective_mode,
+            encoding
+          );
+        result.paddr = pte_phys.paddr;
+        if (PTESIZE >= 64) {
+          result.pbmt = pte_phys.pbmt == Pbmt::PMA ? $enum(Pbmt, pte[62:61]) : pte_phys.pbmt;
+        }
+        result.pte_flags = pte_flags;
+        return result;
+      } else {
+        # found a pointer to the next level
+
+        if (I == 0) {
+          # a pointer can't exist on the last level
+          raise (page_fault_code, mode(), vaddr);
+        }
+
+        if (pte_flags.D == 1 || pte_flags.A == 1 || pte_flags.U == 1) {
+          # D, A, and U are reserved in non-leaf PTEs
+          raise (page_fault_code, mode(), vaddr);
+        }
+
+        if ((VA_SIZE != 32) && (pte[62:61] != 0)) {
+          # PBMT must be zero in a pointer PTE
+          raise (page_fault_code, mode(), vaddr);
+        }
+
+        if ((VA_SIZE != 32) && pte[63] != 0) {
+          # N must be zero in a pointer PTE
+          raise (page_fault_code, mode(), vaddr);
+        }
+
+        # fall through to next level
+        ppn = pte[PA_SIZE-3:10];
+      }
+    }
+  }
+}
+
+function translate {
+  returns
+    TranslationResult         # translated physical address and PBMT value (for Svpbmt)
+  arguments
+    XReg vaddr,
+    MemoryOperation op,
+    PrivilegeMode effective_mode,
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Translate a virtual address for operation type +op+ that appears to execute at
+    +effective_mode+.
+
+    The translation will depend on the effective privilege mode.
+
+    May raise a Page Fault or Access Fault.
+
+    The final physical address is *not* access checked (for PMP, PMA, etc., violations).
+    (though intermediate page table reads will be)
+  }
+  body {
+
+    #####################################################################
+    # First, check for a cached translation result
+    #####################################################################
+
+    Boolean cached_translation_valid;
+    CachedTranslationResult cached_translation_result;
+
+    cached_translation_result =
+      cached_translation(vaddr, op);
+
+    if (cached_translation_result.valid) {
+      return cached_translation_result.result;
+    }
+
+    #####################################################################
+    # No cached translation, so go through the full translation process
+    #####################################################################
+
+    TranslationResult result;
+
+    if (effective_mode == PrivilegeMode::M) {
+      # there is no translation in M-mode
+      result.paddr = vaddr;
+      return result;
+    }
+
+    SatpMode translation_mode =
+      current_translation_mode(effective_mode);
+
+    if (translation_mode == SatpMode::Reserved) {
+      if (op == MemoryOperation::Read) {
+        raise (ExceptionCode::LoadPageFault, mode(), vaddr);
+      } else if (op == MemoryOperation::Write || op == MemoryOperation::ReadModifyWrite) {
+        raise (ExceptionCode::StoreAmoPageFault, mode(), vaddr);
+      } else {
+        assert(op == MemoryOperation::Fetch, "Unexpected memory operation");
+        raise (ExceptionCode::InstructionPageFault, mode(), vaddr);
+      }
+    }
+
+
+    if (translation_mode == SatpMode::Bare) {
+      result.paddr = vaddr;
+    } else if (xlen() == 32 && translation_mode == SatpMode::Sv32) {
+      # Sv32 page table walk
+      result = stage1_page_walk<32, 34, 32, 2>(vaddr, op, effective_mode, encoding);
+    } else if (xlen() == 64 && translation_mode == SatpMode::Sv39) {
+      # Sv39 page table walk
+      result = stage1_page_walk<39, 56, 64, 3>(vaddr, op, effective_mode, encoding);
+    } else if (xlen() == 64 && translation_mode == SatpMode::Sv48) {
+      # Sv48 page table walk
+      result = stage1_page_walk<48, 56, 64, 4>(vaddr, op, effective_mode, encoding);
+    } else if (xlen() == 64 && translation_mode == SatpMode::Sv57) {
+      # Sv57 page table walk
+      result = stage1_page_walk<57, 56, 64, 5>(vaddr, op, effective_mode, encoding);
+    } else {
+      assert(false, "Unexpected SatpMode");
+    }
+
+    maybe_cache_translation(vaddr, op, result);
+    return result;
+  }
+}
+
+function canonical_vaddr? {
+  returns Boolean
+  arguments XReg vaddr
+  description {
+    Returns whether or not _vaddr_ is a valid (_i.e._, canonical) virtual address.
+
+    If pointer masking (S**pm) is enabled, then vaddr will be masked before checking
+    the canonical address.
+  }
+  body {
+    if (CSR[misa].S == 1'b0) {
+      # there is no translation, any address is canonical
+      return true;
+    }
+
+    # canonical depends on the virtual address size in the current translation mode
+    SatpMode satp_mode;
+    if (virtual_mode?()) {
+      satp_mode = $enum(SatpMode, CSR[vsatp].MODE);
+    } else {
+      satp_mode = $enum(SatpMode, CSR[satp].MODE);
+    }
+
+    # calculate the effective address after pointer masking
+    XReg eaddr = mask_eaddr(vaddr);
+
+    if (SATP_MODE_BARE && (satp_mode == SatpMode::Bare)) {
+      return true;
+    } else if ((MXLEN == 32) && satp_mode == SatpMode::Sv32) {
+      # Sv32 uses all 32 bits of the VA
+      return true;
+    } else if ((MXLEN == 64) && satp_mode == SatpMode::Sv39) {
+      return eaddr[63:39] == {25{eaddr[38]}};
+    } else if ((MXLEN == 64) && satp_mode == SatpMode::Sv48) {
+      return eaddr[63:48] == {16{eaddr[47]}};
+    } else if ((MXLEN == 64) && satp_mode == SatpMode::Sv57) {
+      return eaddr[63:57] == {6{eaddr[56]}};
+    }
+  }
+}
+
+function canonical_gpaddr? {
+  returns Boolean
+  arguments XReg gpaddr
+  description {
+    Returns whether or not +gpaddr+ is a valid (_i.e._, canonical) guest physical address.
+  }
+  body {
+
+    # canonical depends on the virtual address size in the current translation mode
+    SatpMode satp_mode = $enum(SatpMode, CSR[satp].MODE);
+
+    if (satp_mode == SatpMode::Bare) {
+      return true;
+    } else if (satp_mode == SatpMode::Sv32) {
+      # Sv32 uses all 32 bits of the VA
+      return true;
+    } else if ((MXLEN > 32) && (satp_mode == SatpMode::Sv39)) {
+      return gpaddr[63:39] == {25{gpaddr[38]}};
+    } else if ((MXLEN > 32) && (satp_mode == SatpMode::Sv48)) {
+      return gpaddr[63:48] == {16{gpaddr[47]}};
+    } else if ((MXLEN > 32) && (satp_mode == SatpMode::Sv57)) {
+      return gpaddr[63:57] == {6{gpaddr[56]}};
+    }
+  }
+}
+
+function misaligned_is_atomic? {
+  template U32 N
+  returns Boolean
+  arguments Bits<PHYS_ADDR_WIDTH> physical_address
+  description {
+    Returns true if an access starting at +physical_address+ that is +N+ bits long is atomic.
+
+    This function takes into account any Atomicity Granule PMAs, so *it should not be used
+    for load-reserved/store-conditional*, since those PMAs do not apply to those accesses.
+  }
+  body {
+    # if the hart doesn't support Misligned Atomicity Granules,
+    # then this misligned access is not atomic
+    return false if MISALIGNED_MAX_ATOMICITY_GRANULE_SIZE == 0;
+
+    if (pma_applies?(PmaAttribute::MAG16, physical_address, N) &&
+        in_naturally_aligned_region?<128>(physical_address, N)) {
+      return true;
+    } else if (pma_applies?(PmaAttribute::MAG8, physical_address, N) &&
+                in_naturally_aligned_region?<64>(physical_address, N)) {
+      return true;
+    } else if (pma_applies?(PmaAttribute::MAG4, physical_address, N) &&
+                in_naturally_aligned_region?<32>(physical_address, N)) {
+      return true;
+    } else if (pma_applies?(PmaAttribute::MAG2, physical_address, N) &&
+                in_naturally_aligned_region?<16>(physical_address, N)) {
+      return true;
+    } else {
+      # not saved by a Misaligned Atomicity Granule
+      return false;
+    }
+  }
+}
+
+function read_memory_aligned {
+  template U32 LEN
+  returns Bits<LEN>
+  arguments
+    XReg virtual_address,
+    Bits<INSTR_ENC_SIZE> encoding   # the encoding of an instruction causing this access
+  description {
+    Read from virtual memory using a known aligned address.
+  }
+  body {
+    TranslationResult result;
+
+    if (CSR[misa].S == 1) {
+      result = translate(virtual_address, MemoryOperation::Read, effective_ldst_mode(), encoding);
+    } else {
+      result.paddr = virtual_address;
+    }
+
+    # may raise an exception
+    access_check(result.paddr, LEN, virtual_address, MemoryOperation::Read, ExceptionCode::LoadAccessFault, effective_ldst_mode());
+
+    return read_physical_memory<LEN>(result.paddr);
+  }
+}
+
+function read_memory {
+  template U32 LEN
+  returns Bits<LEN>
+  arguments
+    XReg virtual_address,
+    Bits<INSTR_ENC_SIZE> encoding   # the encoding of an instruction causing this access, or 0 if a fetch
+  description {
+    Read from virtual memory.
+
+  }
+  body {
+    Boolean aligned = is_naturally_aligned<LEN>(virtual_address);
+    XReg physical_address;
+
+    if (aligned) {
+      return read_memory_aligned<LEN>(virtual_address, encoding);
+    }
+
+    # access isn't naturally aligned, but it still might be atomic if this hart supports
+    # Misliagned Atomicity Granules. We won't know that, though, until after translation since PMAs
+    # apply to physical addresses
+    if (MISALIGNED_MAX_ATOMICITY_GRANULE_SIZE > 0) {
+      # sanity check that the implementation isn't expecting a Misaligned exception
+      # before an access/page fault exception (that would be an invalid config)
+      assert(MISALIGNED_LDST_EXCEPTION_PRIORITY == "low", "Invalid config: can't mix low-priority misaligned exceptions with large atomicity granule");
+
+      physical_address = (CSR[misa].S == 1)
+        ? translate(virtual_address, MemoryOperation::Read, effective_ldst_mode(), encoding).paddr
+        : virtual_address;
+
+      if (misaligned_is_atomic?<LEN>(physical_address)) {
+        access_check(physical_address, LEN, virtual_address, MemoryOperation::Read, ExceptionCode::LoadAccessFault, effective_ldst_mode());
+        return read_physical_memory<LEN>(physical_address);
+      }
+    }
+
+    # at this point, we have a misligned access
+    if (!MISALIGNED_LDST) {
+      # misaligned is not supported, we'll raise either a Misaligned exception or
+      # a page/access fault exception, depending on the configuration
+      if (MISALIGNED_LDST_EXCEPTION_PRIORITY == "low") {
+        # do translation to trigger any access/page faults before raising misaligned
+        physical_address = (CSR[misa].S == 1)
+          ? translate(virtual_address, MemoryOperation::Read, effective_ldst_mode(), encoding).paddr
+          : virtual_address;
+        access_check(physical_address, LEN, virtual_address, MemoryOperation::Read, ExceptionCode::LoadAccessFault, effective_ldst_mode());
+      }
+      raise (ExceptionCode::LoadAddressMisaligned, mode(), virtual_address);
+    } else {
+
+      # misaligned, must break into multiple reads
+      if (MISALIGNED_SPLIT_STRATEGY == "sequential_bytes") {
+        Bits<LEN> result = 0;
+        for (U32 I = 0; I < (LEN/8); I++) {
+          result = result | (read_memory_aligned<8>(virtual_address + I, encoding) `<< (8*I));
+        }
+        return result;
+      } else if (MISALIGNED_SPLIT_STRATEGY == "custom") {
+        unpredictable("An implementation is free to break a misaligned access any way, leading to unpredictable behavior when any part of the misaligned access causes an exception");
+      }
+    }
+  }
+}
+
+function read_memory_xlen {
+  returns Bits<MXLEN>
+  arguments
+    XReg virtual_address,
+    Bits<INSTR_ENC_SIZE> encoding
+  description {
+    Read XLEN bits from memory
+  }
+  body {
+    if (xlen() == 32) {
+      return read_memory<32>(virtual_address, encoding);
+    } else {
+      return read_memory<64>(virtual_address, encoding);
+    }
+  }
+}
+
+function write_memory_xlen {
+  arguments
+    XReg virtual_address,
+    Bits<MXLEN> value,
+    Bits<INSTR_ENC_SIZE> encoding
+  description {
+    Read XLEN bits from memory
+  }
+  body {
+    if (xlen() == 32) {
+      return write_memory<32>(virtual_address, value, encoding);
+    } else {
+      return write_memory<64>(virtual_address, value, encoding);
+    }
+  }
+}
+
+function read_memory_xlen_aligned {
+  returns Bits<MXLEN>
+  arguments
+    XReg virtual_address,
+    Bits<INSTR_ENC_SIZE> encoding   # the encoding of an instruction causing this access, or 0 if a fetch
+  description {
+    Read from virtual memory XLEN (which may be runtime-determined) bits using a known aligned address.
+  }
+  body {
+    TranslationResult result;
+
+    if (CSR[misa].S == 1) {
+      result = translate(virtual_address, MemoryOperation::Read, effective_ldst_mode(), encoding);
+    } else {
+      result.paddr = virtual_address;
+    }
+
+    # may raise an exception
+    access_check(result.paddr, xlen(), virtual_address, MemoryOperation::Read, ExceptionCode::LoadAccessFault, effective_ldst_mode());
+
+    if (xlen() == 32) {
+      return read_physical_memory<32>(result.paddr);
+    } else {
+      return read_physical_memory<64>(result.paddr);
+    }
+  }
+}
+
+# hart-global state to track the local reservation set
+Boolean    reservation_set_valid = false;
+XReg       reservation_set_address;
+XReg       reservation_set_size;
+XReg       reservation_physical_address;  # The exact address used by the LR.W/LR.D
+XReg       reservation_virtual_address;   # The exact address used by the LR.W/LR.D
+XReg       reservation_size;              # the size of the LR operation (32 or 64)
+
+function invalidate_reservation_set {
+  description {
+    Invalidates any currently held reservation set.
+
+    [NOTE]
+    --
+    This function may be called by the platform, independent of any actions
+    occurring in the local hart, for any or no reason.
+
+    The platform *must* call this function if an external hart or device accesses
+    part of this reservation set while reservation_set_valid could be true.
+    --
+  }
+  body {
+    reservation_set_valid = false;
+  }
+}
+
+function register_reservation_set {
+  arguments
+    Bits<MXLEN> physical_address,   # The (always aligned) physical address to reserve.
+    Bits<MXLEN> length              # minimum length of the reservation. actual reservation may be larger
+  description {
+    Register a reservation for a physical address range that subsumes
+    [physical_address, physical_address + N).
+  }
+  body {
+    reservation_set_valid = true;
+    reservation_set_address = physical_address;
+
+    if (LRSC_RESERVATION_STRATEGY == "reserve naturally-aligned 64-byte region") {
+      reservation_set_address = physical_address & ~MXLEN'h3f;
+      reservation_set_size = 64;
+    } else if (LRSC_RESERVATION_STRATEGY == "reserve naturally-aligned 128-byte region") {
+      reservation_set_address = physical_address & ~MXLEN'h7f;
+      reservation_set_size = 128;
+    } else if (LRSC_RESERVATION_STRATEGY == "reserve exactly enough to cover the access") {
+      reservation_set_address = physical_address;
+      reservation_set_size = length;
+    } else if (LRSC_RESERVATION_STRATEGY == "custom") {
+      unpredictable("Implementations may set reservation sets of any size, as long as they cover the reserved accessed");
+    } else {
+      assert(false, "Unexpected LRSC_RESERVATION_STRATEGY");
+    }
+  }
+}
+
+function load_reserved {
+  template U32 N                # the number of bits being loaded
+  returns Bits<N>               # the value of memory at virtual_address
+  arguments
+    Bits<MXLEN> virtual_address, # the virtual address to load
+    Bits<1>    aq,              # acquire semantics? 0=no, 1=yes
+    Bits<1>    rl,              # release semantics? 0=no, 1=yes
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Register a reservation for virtual_address at least N bits long
+    and read the value from memory.
+
+    If aq is set, then also perform a memory model acquire.
+
+    If rl is set, then also perform a memory model release (software is discouraged from doing so).
+
+    This function assumes alignment checks have already occurred.
+  }
+  body {
+    Bits<PHYS_ADDR_WIDTH> physical_address =
+      (CSR[misa].S == 1)
+        ? translate(virtual_address, MemoryOperation::Read, effective_ldst_mode(), encoding).paddr
+        : virtual_address;
+
+    if (pma_applies?(PmaAttribute::RsrvNone, physical_address, N)) {
+      raise(ExceptionCode::LoadAccessFault, mode(), virtual_address);
+    }
+
+    if (aq == 1) {
+      memory_model_acquire();
+    }
+    if (rl == 1) {
+      memory_model_release();
+    }
+
+    register_reservation_set(physical_address, N);
+
+    if (CSR[misa].S ==1 && LRSC_FAIL_ON_VA_SYNONYM) {
+      # also need to remember the virtual address
+      reservation_virtual_address = virtual_address;
+    }
+
+    return read_memory_aligned<N>(physical_address, encoding);
+  }
+}
+
+function store_conditional {
+  template U32 N                  # number of bits being stored
+  returns Boolean                 # whether or not the store conditional succeeded
+  arguments
+    Bits<MXLEN> virtual_address,  # the virtual address to store to
+    Bits<MXLEN> value,            # the value to store
+    Bits<1>    aq,                # acquire semantics? 0=no, 1=yes
+    Bits<1>    rl,                # release semantics? 0=no, 1=yes
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Atomically check the reservation set to ensure:
+
+     * it is valid
+     * it covers the region addressed by this store
+     * the address setting the reservation set matches virtual address
+
+    If the preceding are met, perform the store and return 0.
+    Otherwise, return 1.
+  }
+  body {
+    Bits<PHYS_ADDR_WIDTH> physical_address =
+      (CSR[misa].S == 1)
+        ? translate(virtual_address, MemoryOperation::Write, effective_ldst_mode(), encoding).paddr
+        : virtual_address;
+
+    if (pma_applies?(PmaAttribute::RsrvNone, physical_address, N)) {
+      raise(ExceptionCode::StoreAmoAccessFault, mode(), virtual_address);
+    }
+
+    # failed SC still looks like a store to memory protection
+    access_check(physical_address, N, virtual_address, MemoryOperation::Write, ExceptionCode::StoreAmoAccessFault, effective_ldst_mode());
+
+    # acquire/release occur regardless of whether or not the SC succeeds
+    if (aq == 1) {
+      memory_model_acquire();
+    }
+    if (rl == 1) {
+      memory_model_release();
+    }
+
+    if (reservation_set_valid == false) {
+      return false;
+    }
+
+    if (!contains?(reservation_set_address, reservation_set_size, physical_address, N)) {
+      # this access is not in the reservation set
+      invalidate_reservation_set();
+      return false;
+    }
+
+    if (LRSC_FAIL_ON_NON_EXACT_LRSC) {
+      if (reservation_physical_address != physical_address || reservation_size != N) {
+        # this access does not match the most recent LR
+        invalidate_reservation_set();
+        return false;
+      }
+    }
+
+    if (LRSC_FAIL_ON_VA_SYNONYM) {
+      if (reservation_virtual_address != virtual_address || reservation_size != N) {
+        # this access does not match the most recent LR
+        invalidate_reservation_set();
+        return false;
+      }
+    }
+
+    # success. perform the store
+    write_physical_memory<N>(physical_address, value);
+
+    return true;
+  }
+}
+
+function amo {
+  template U32 N           # number of bits being loaded/stored
+  returns Bits<N>
+  arguments
+    XReg virtual_address,  # the virtual address to load from/store to
+    Bits<N> value,         # the value for the second half of the atomic operation
+    AmoOperation op,       # atomic operation to apply
+    Bits<1>    aq,         # acquire semantics? 0=no, 1=yes
+    Bits<1>    rl,         # release semantics? 0=no, 1=yes
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Atomically read-modify-write the location at virtual_address.
+
+    The value written to virtual_address will depend on +op+.
+
+    If +aq+ is 1, then the amo also acts as a memory model acquire.
+    If +rl+ is 1, then the amo also acts as a memory model release.
+  }
+  body {
+    Boolean aligned = is_naturally_aligned<N>(virtual_address);
+
+    if (!aligned && MISALIGNED_LDST_EXCEPTION_PRIORITY == "high") {
+      raise(ExceptionCode::StoreAmoAddressMisaligned, mode(), virtual_address);
+    }
+
+    Bits<PHYS_ADDR_WIDTH> physical_address =
+      (CSR[misa].S == 1)
+        ? translate(virtual_address, MemoryOperation::ReadModifyWrite, effective_ldst_mode(), encoding).paddr
+        : virtual_address;
+
+    # PMA Atomicity checks
+    if (pma_applies?(PmaAttribute::AmoNone, physical_address, N)) {
+      raise(ExceptionCode::StoreAmoAccessFault, mode(), virtual_address);
+    } else if (((op == AmoOperation::Add || op == AmoOperation::Max || op == AmoOperation::Maxu || op == AmoOperation::Min || op == AmoOperation::Minu)) &&
+               !pma_applies?(PmaAttribute::AmoArithmetic, physical_address, N)) {
+      raise(ExceptionCode::StoreAmoAccessFault, mode(), virtual_address);
+    } else if (((op == AmoOperation::And || op == AmoOperation::Or || op == AmoOperation::Xor)) &&
+                !pma_applies?(PmaAttribute::AmoLogical, physical_address, N)) {
+      raise(ExceptionCode::StoreAmoAccessFault, mode(), virtual_address);
+    } else {
+      assert(
+        pma_applies?(PmaAttribute::AmoSwap, physical_address, N) &&
+        op == AmoOperation::Swap,
+        "Bad AMO operation"
+      );
+    }
+
+    # pma alignment checks
+    if (!aligned &&
+         !misaligned_is_atomic?<N>(physical_address)) {
+      raise (ExceptionCode::StoreAmoAddressMisaligned, mode(), virtual_address);
+    }
+
+    if (N == 32) {
+      return atomic_read_modify_write_32(physical_address, value, op);
+    } else {
+      return atomic_read_modify_write_64(physical_address, value, op);
+    }
+
+  }
+}
+
+
+
+function write_memory_aligned {
+  template U32 LEN
+  arguments
+    XReg virtual_address,
+    Bits<LEN> value,
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Write to virtual memory using a known aligned address.
+  }
+  body {
+    XReg physical_address;
+
+    physical_address = (CSR[misa].S == 1)
+      ? translate(virtual_address, MemoryOperation::Write, effective_ldst_mode(), encoding).paddr
+      : virtual_address;
+
+    # may raise an exception
+    access_check(physical_address, LEN, virtual_address, MemoryOperation::Write, ExceptionCode::StoreAmoAccessFault, effective_ldst_mode());
+
+    write_physical_memory<LEN>(physical_address, value);
+  }
+}
+
+function write_memory {
+  template U32 LEN
+  arguments
+    XReg virtual_address,
+    Bits<LEN> value,
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Write to virtual memory
+  }
+  body {
+    Boolean aligned = is_naturally_aligned<LEN>(virtual_address);
+    XReg physical_address;
+
+    if (aligned) {
+      write_memory_aligned<LEN>(virtual_address, value, encoding);
+      return;
+    }
+
+    # access isn't naturally aligned, but it still might be atomic if this hart supports
+    # Misliagned Atomicity Granules. We won't know that, though, until after translation since PMAs
+    # apply to physical addresses
+    if (MISALIGNED_MAX_ATOMICITY_GRANULE_SIZE > 0) {
+      # sanity check that the implementation isn't expecting a Misaligned exception
+      # before an access/page fault exception (that would be an invalid config)
+      assert(MISALIGNED_LDST_EXCEPTION_PRIORITY == "low", "Invalid config: can't mix low-priority misaligned exceptions with large atomicity granule");
+
+      physical_address = (CSR[misa].S == 1)
+        ? translate(virtual_address, MemoryOperation::Write, effective_ldst_mode(), encoding).paddr
+        : virtual_address;
+
+      if (misaligned_is_atomic?<LEN>(physical_address)) {
+        access_check(physical_address, LEN, virtual_address, MemoryOperation::Write, ExceptionCode::StoreAmoAccessFault, effective_ldst_mode());
+        write_physical_memory<LEN>(physical_address, value);
+        return;
+      }
+    }
+
+    # at this point, we have a misligned access that must be split
+    if (!MISALIGNED_LDST) {
+      # misaligned is not supported, we'll raise either a Misaligned exception or
+      # a page/access fault exception, depending on the configuration
+      if (MISALIGNED_LDST_EXCEPTION_PRIORITY == "low") {
+        # do translation to trigger any access/page faults before raising misaligned
+        physical_address = (CSR[misa].S == 1)
+          ? translate(virtual_address, MemoryOperation::Write, effective_ldst_mode(), encoding).paddr
+          : virtual_address;
+        access_check(physical_address, LEN, virtual_address, MemoryOperation::Write, ExceptionCode::StoreAmoAccessFault, effective_ldst_mode());
+      }
+      raise (ExceptionCode::StoreAmoAddressMisaligned, mode(), virtual_address);
+    } else {
+      # misaligned, must break into multiple reads
+      if (MISALIGNED_SPLIT_STRATEGY == "sequential_bytes") {
+        for (U32 I = 0; I < (LEN/8); I++) {
+          write_memory_aligned<8>(virtual_address + I, (value >> (8*I))[7:0], encoding);
+        }
+      } else if (MISALIGNED_SPLIT_STRATEGY == "custom") {
+        unpredictable("An implementation is free to break a misaligned access any way, leading to unpredictable behavior when any part of the misaligned access causes an exception");
+      }
+    }
+  }
+}
+
+function write_memory_xlen_aligned {
+  arguments
+    XReg virtual_address,
+    Bits<MXLEN> value,
+    Bits<INSTR_ENC_SIZE> encoding # encoding of the instruction causing this access
+  description {
+    Write to virtual memory XLEN bits (which may be runtime determined) using a known aligned address.
+  }
+  body {
+    XReg physical_address;
+
+    physical_address = (CSR[misa].S == 1)
+      ? translate(virtual_address, MemoryOperation::Write, effective_ldst_mode(), encoding).paddr
+      : virtual_address;
+
+    # may raise an exception
+    access_check(physical_address, xlen(), virtual_address, MemoryOperation::Write, ExceptionCode::StoreAmoAccessFault, effective_ldst_mode());
+
+    if (xlen() == 32) {
+      write_physical_memory<32>(physical_address, value);
+    } else {
+      write_physical_memory<64>(physical_address, value);
+    }
+  }
+}
+
+function mstatus_sd_has_known_reset
+{
+  returns Boolean
+  description {
+    Returns true if the mstatus.SD bit has a defined reset value, as determined by various parameters.
+  }
+  body {
+    # the reset value is known if both FS and VS are known
+
+    Boolean fs_has_single_value =
+      ((!implemented?(ExtensionName::F)) || ($array_size(MSTATUS_FS_LEGAL_VALUES) == 1));
+
+    Boolean vs_has_single_value =
+      ((!implemented?(ExtensionName::V)) || ($array_size(MSTATUS_VS_LEGAL_VALUES) == 1));
+
+    return fs_has_single_value && vs_has_single_value;
+  }
+}
+
+function mstatus_sd_reset_value
+{
+  returns Bits<1>
+  description {
+    Returns the reset value of mstatus.SD when known
+  }
+  body {
+    # the reset value is known if both FS and VS are known
+    assert(mstatus_sd_has_known_reset(),
+           "mstatus_sd_reset_value is only defined when mstatus_sd_has_known_reset() == true");
+
+    Bits<2> fs_value, vs_value; # defaults to 0
+
+    if ((!implemented?(ExtensionName::F)) || ($array_size(MSTATUS_FS_LEGAL_VALUES) == 1)) {
+      fs_value = (!implemented?(ExtensionName::F)) ? 0 : MSTATUS_FS_LEGAL_VALUES[0];
+    }
+    if ((!implemented?(ExtensionName::V)) || ($array_size(MSTATUS_VS_LEGAL_VALUES) == 1)) {
+      fs_value = (!implemented?(ExtensionName::V)) ? 0 : MSTATUS_VS_LEGAL_VALUES[0];
+    }
+
+    return ((fs_value == 3) || (vs_value == 3)) ? 1 : 0;
+  }
+}
+
+function check_zcmt_enabled {
+  arguments
+    Bits<INSTR_ENC_SIZE> encoding
+  description {
+    If the Smstateen extension is implemented, then bit 2 in `mstateen0`, `sstateen0`, and `hstateen0` is
+    implemented. If bit 2 of a controlling `stateen0` CSR is zero, then access to the `jvt` CSR and execution
+    of a `cm.jalt` or `cm.jt` instruction by a lower privilege level results in an illegal-instruction trap (or, if
+    appropriate, a virtual-instruction trap).
+  }
+  body {
+    if (( mode() != PrivilegeMode::M && implemented?(ExtensionName::Smstateen)
+          && CSR[mstateen0].JVT == 1'b0 )
+        ||
+        ( mode() == PrivilegeMode::U && implemented?(ExtensionName::Ssstateen)
+          && CSR[sstateen0].JVT == 1'b0 )) {
+
+      raise(ExceptionCode::IllegalInstruction, mode(), encoding);
+    }
+    else
+      if (( mode() == PrivilegeMode::VS && implemented?(ExtensionName::Ssstateen)
+            && CSR[hstateen0].JVT == 1'b0 )
+          ||
+          ( mode() == PrivilegeMode::VU && implemented?(ExtensionName::Ssstateen)
+            && (CSR[sstateen0].JVT == 1'b0 || CSR[hstateen0].JVT == 1'b0) )) {
+
+        raise(ExceptionCode::VirtualInstruction, mode(), encoding);
+      }
+  }
+}